CVE-2026-5397

CVE-2026-5397 is a privilege escalation vulnerability affecting UPS management applications, stemming from improper permission controls on the installation directory. An authenticated local attacker can exploit weak DLL loading mechanisms (CWE-427) by placing a malicious DLL in the application directory, which is subsequently executed with administrator privileges during service startup, potentially compromising system integrity and confidentiality. The vulnerability presents a HIGH severity profile with a CVSS score of 7.8, requiring local access and moderate attack complexity but delivering significant impact across confidentiality, integrity, and availability. The attack requires user-level privileges but does not require user interaction, making it exploitable in scenarios where an attacker has gained initial access to the system. Exploitation of this vulnerability remains dormant, with no evidence of active exploitation in the wild. The vulnerability is not listed on the Known Exploited Vulnerabilities catalog, has no publicly available proof-of-concept code, and maintains low community attention metrics, suggesting limited immediate threat to operational networks. However, the technical simplicity of DLL hijacking exploits warrants prioritized remediation to prevent future weaponization.