CVE Intelligence
Analysis AI-assisted

CVE-2026-25785: MOTEX Lanscope Endpoint Manager path traversal

CVE-2026-25785 is a path traversal flaw (CWE-22) in the Sub-Manager Server component of MOTEX Lanscope Endpoint Manager (On-Premises), in version 9.4.7.3 and earlier, as recorded through the JPCERT CNA. The record gives a CVSS base score of 9.8 (critical) and states that an attacker could tamper with arbitrary files and execute arbitrary code. The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-25785 is a path traversal weakness (CWE-22) affecting the Sub-Manager Server component of MOTEX Lanscope Endpoint Manager (On-Premises). According to the record, the flaw may allow an attacker to tamper with arbitrary files and execute arbitrary code on the affected system. The vendor notice and a JVN advisory are listed as references.

Impact

  • The CVSS vector in the record rates confidentiality, integrity and availability impact as High, and the attack as network-reachable with no privileges or user interaction required.
  • The record's CVSS base score is 9.8, and it also lists a score of 9.3 under a newer CVSS edition.
  • SSVC data in the record rates technical impact as total and automatable as yes.

Affected products and versions

  • MOTEX Inc. Lanscope Endpoint Manager: before 9.4.8.0.
  • MOTEX Inc. Lanscope Endpoint Manager (On-Premises) Sub-Manager Server: 9.4.7.3 and earlier.

The record does not explicitly state a fixed version. The boundary 9.4.8.0 appears in the affected range, but whether that release is the fix should be confirmed in the vendor notice.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed active exploitation or exploitation in the wild appears in the sources consulted. The record gives an EPSS probability of 0.00964 (percentile 0.61333), and SSVC exploitation is recorded as none.

Remediation and mitigation

  • Check the installed version of every Lanscope Endpoint Manager and Sub-Manager Server instance against the ranges above.
  • Consult the MOTEX notice for the update to apply, since the record does not give the patch details.
  • Until updated, restrict network access to management servers to trusted administrative networks.

Detection guidance

  • Review Sub-Manager Server logs for unexpected file access, modification or creation outside the expected directories.
  • Monitor for unusual processes started by the management service account.
  • Keep file integrity monitoring enabled on critical endpoint management components.

Limitations of the available information

  • The record does not describe the technical details of the vulnerable code path.
  • No explicit fixed version is given, so the remediation target must come from the vendor notice.
  • The EPSS date in the record is 2026-10-23, which is later than the publication date and should be verified against the data source.
  • The JVN advisory is cited in the record, but its content was not reviewed here.

Frequently asked questions

Is CVE-2026-25785 being actively exploited?

The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted. Keep monitoring the vendor notice and the JVN advisory for updates.

Which versions are affected?

The record lists Sub-Manager Server 9.4.7.3 and earlier, and Lanscope Endpoint Manager before 9.4.8.0.

What should administrators do first?

Verify installed versions, follow the update guidance in the MOTEX notice, and restrict network access to management servers until they are updated.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.