CVE-2026-57895: Pupsman Local Privilege Escalation via Incorrect Default Permissions

Technical summary

CVE-2026-57895 is a privilege escalation vulnerability rooted in CWE-276 (Incorrect Default Permissions). Pupsman's installation folder is created with overly permissive access controls, enabling a local user to write executable files to a directory that the application—or the system—later executes with SYSTEM privilege. The vulnerability affects all versions prior to 3.9.0. The CVSS 3.0 score of 7.8 (HIGH severity) reflects the local attack vector, low complexity, requirement for low privileges, and the complete impact on confidentiality, integrity, and availability once exploitation succeeds.

Business impact

Successful exploitation results in complete system compromise. An attacker with local access can execute arbitrary code as SYSTEM, enabling them to install backdoors, steal credentials, disable security tools, or move laterally within the network. In environments where Pupsman runs on shared systems or where user segmentation is weak, this could facilitate privilege escalation chains or persistent access for insider threats or compromised service accounts.

Affected systems

Pupsman versions prior to 3.9.0 are affected. Organizations should inventory systems running Pupsman and immediately identify which are at versions below 3.9.0. The vulnerability requires local access, making internet-facing systems a lower direct risk unless remote code execution vulnerabilities or remote access services are present on the same host.

Exploitability

Exploitation requires local user access and low complexity; an attacker simply places a malicious executable in the Pupsman installation folder and waits for it to be executed or triggers execution through normal application operation. The barrier to exploitation is relatively low for an attacker with a foothold on the system. The vulnerability is not listed on the CISA KEV catalog, suggesting it may not yet be actively exploited in the wild, though this does not diminish its risk to organizations running vulnerable versions.

Remediation

Upgrade to Pupsman 3.9.0 or later immediately. Verify against the vendor advisory that 3.9.0 addresses CWE-276 and includes corrected default permissions. As an interim control on systems that cannot be patched immediately, restrict write access to the Pupsman installation directory to the application's service account and administrative users only; audit and remove any unexpected executables from that directory.

Patch guidance

Deploy Pupsman 3.9.0 or later across all affected instances. Test the upgrade in a non-production environment first to confirm compatibility with your configuration and any downstream integrations. Verify that post-upgrade, the installation directory has restrictive permissions (e.g., read/execute for users, write only for administrators or the service account). Document the patching timeline in your change management system.

Detection guidance

Monitor for suspicious file creation or modification in Pupsman installation directories, particularly executable files with unexpected ownership or timestamps. Audit local user account activity and privilege escalation attempts on systems running Pupsman. Look for process execution from the installation folder with unusual parent-child relationships. Use file integrity monitoring (FIM) to alert on unauthorized changes to the Pupsman directory. Review access control lists (ACLs) on the installation folder to identify overly permissive configurations as indicators of vulnerability.

Why prioritize this

Although not yet in active exploit, the high CVSS score (7.8), straightforward exploitation path, and complete system compromise potential warrant priority patching. Organizations should prioritize systems where Pupsman runs on multi-user systems, shared hosting, or where user access control is difficult to enforce. Patching is straightforward—upgrade to 3.9.0—making remediation low-effort relative to risk.

Risk score, explained

The CVSS 3.0 score of 7.8 reflects a High severity rating driven by: (1) local attack vector (AV:L), reducing exposure but not eliminating it in multi-tenant or shared environments; (2) low attack complexity (AC:L), indicating straightforward exploitation; (3) low privilege requirements (PR:L), needing only basic user access; and (4) high impact across all three security dimensions (C:H, I:H, A:H), as SYSTEM-level execution enables complete system takeover. The vulnerability's availability in older versions without KEV status suggests moderate—not critical—immediate real-world threat, but the technical severity remains high.

Frequently asked questions