Loading story…
RATOC Systems' RAID Monitoring Manager for Windows is affected by two high-severity installer vulnerabilities that can let attackers execute arbitrary code with elevated privileges. CVE-2026-32680 is a local privilege escalation flaw tied to custom installation paths: when the software is installed outside the default directory, insecure ACLs can leave the target folder writable by non-administrative users, creating a path to SYSTEM-level code execution. The issue is classified as CWE-276 and carries high impact across confidentiality, integrity, and availability.
A second flaw, CVE-2026-28760, affects the same installer through improper DLL loading. The installer searches the current directory for certain DLLs, so an attacker who places a crafted DLL next to the installer and convinces a user to run it can achieve arbitrary code execution with administrator privileges. That issue is classified as CWE-427, and both vulnerabilities were published through JPCERT/JVN-linked advisories and RATOC references as high-severity Windows privilege-escalation risks.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-26, JPCERT/CC received a report for CVE-2026-32680 affecting the RATOC RAID Monitoring Manager for Windows installer. The vulnerability involves insecure ACLs on a user-selected non-default installation directory, which can let non-administrative users modify contents and potentially execute code with SYSTEM privileges.
On 2026-03-26, JPCERT/CC received a report for CVE-2026-28760 affecting the RATOC RAID Monitoring Manager for Windows installer. The flaw is a DLL search order issue that can allow arbitrary code execution with administrator privileges if a crafted DLL is placed alongside the installer and a user runs it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
STAR Labs disclosed two high-severity local privilege escalation vulnerabilities in **Razer CentralService** affecting **Razer Central 7.11.0.558 and earlier**. The bugs, tracked as `CVE-2023-3513` and `CVE-2023-3514`, allow a low-privileged Windows user to execute code as **SYSTEM** through insecure service design in `RazerCentralService.exe`. One flaw stems from unsafe deserialization of `ConnectedAccounts.bin`, which is decrypted with a hardcoded AES-CBC key and processed with `BinaryFormatter`; the other involves unsafe handling of commands received over a broadly accessible named pipe. According to the advisory, attackers can abuse user-writable paths under `C:\ProgramData\Razer\Razer Central\Accounts` and the service's permissive named pipe access to trigger privileged functionality. STAR Labs said the exposed `UpdateManager` interface includes commands such as `AddModule` and `UninstallModules`, which can be manipulated with malicious XML to create a fake module and launch an attacker-controlled binary as SYSTEM. The researchers reported exploitation can be triggered during login, restart, or directly through the named pipe, and recommended removing `BinaryFormatter`, tightening named pipe permissions, sanitizing untrusted input, and correcting directory permissions.
Jun 29, 2026
Microsoft released fixes for multiple Windows local vulnerabilities affecting core services used in enterprise environments. One issue in the **Remote Access Connection Manager (RasMan)** service was exploited to trigger a local **denial-of-service (DoS)** by crashing the remote access service, which can disrupt **VPN connectivity** and interrupt remote access workflows on unpatched systems; Microsoft described the condition as allowing an “unauthorized attacker to deny service locally.” Separately, Microsoft patched **CVE-2026-20817**, a **Windows Error Reporting Service** (*wersvc.dll*) local privilege escalation that can allow a standard user to obtain **SYSTEM-level** execution via ALPC messaging and insufficient authorization checks in request handling (notably around `CWerService::SvcElevatedLaunch`). Reporting indicates the service could be coerced into creating a new token derived from the WER service’s SYSTEM token (with `SeTcbPrivilege` removed but other powerful rights retained), enabling high-impact post-exploitation actions such as credential theft and full host takeover; a **proof-of-concept (PoC)** was also reported as available.
Jun 29, 2026
A critical vulnerability in the JumpCloud Remote Assist for Windows agent (CVE-2025-34352) allows a standard user on a company-managed device to gain full, persistent SYSTEM-level control. The flaw, discovered by XM Cyber, arises from the agent's uninstallation process, which performs privileged file operations in a user-controlled temporary folder. This enables local users to exploit the uninstall routine to overwrite or delete sensitive system files, resulting in either local privilege escalation or denial of service. Over 180,000 organizations using JumpCloud are potentially at risk until the issue is remediated. Separately, Microsoft’s Windows Admin Center (WAC) is affected by a local privilege escalation vulnerability (CVE-2025-64669) due to insecure directory permissions on `C:\ProgramData\WindowsAdminCenter`. Standard users can write to this directory, which is also accessed by services running with elevated privileges, allowing attackers to exploit extension uninstall mechanisms or DLL hijacking to obtain SYSTEM-level access. Both vulnerabilities highlight the risks posed by improper privilege separation and insecure file system permissions in widely deployed Windows management tools.
Jun 29, 2026