JVN#08057419    
Multiple vulnerabilities in the installer of RATOC RAID Monitoring Manager for Windows

The installer of RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. contains multiple vulnerabilities.

• RATOC RAID Monitoring Manager for Windows versions prior to 2.00.009.260220

The installer of RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. contains multiple vulnerabilities listed below.

• Uncontrolled search path element (CWE-427)
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.4
  • CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Base Score 7.8
  • CVE-2026-28760
• Incorrect default permissions (CWE-276)
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.5
  • CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 7.8
  • CVE-2026-32680

• If a user is directed to place a crafted DLL with the installer, an arbitrary code may be executed with the administrator privilege (CVE-2026-28760)
• If the installation folder is customized to some non-default one, the folder may be left with un-secure ACLs and non-administrative users can alter contents of that folder. It may allow a non-administrative user to execute an arbitrary code with SYSTEM privilege (CVE-2026-32680)

Update the Software
Update RATOC RAID Monitoring Manager for Windows to the latest version.
For more details, refer to the information provided by the developer.

Vendor	Link
RATOC Systems, Inc.	Notice Regarding Vulnerability in RAID Monitoring Manager (Text in Japanese)

1. Japan Vulnerability Notes JVNTA#91240916
   Insecure DLL Loading and Command Execution Issues on Many Windows Application Programs

Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.