CVE-2026-33253

Severity: high (CVSS 8.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-25 · updated 2026-06-17
Weakness: CWE-428

Description

SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

Affected products

SANYO DENKI CO., LTD. SANUPS SOFTWARE: from Ver.2.0.0 through Ver.2.0.2; from Ver.1.0.0 through Ver.1.1.4
SANYO DENKI CO., LTD. SANUPS SOFTWARE STANDALONE: from Ver.1.0.1 through Ver.1.1.4

References

https://jvn.jp/en/jp/JVN90835713/
https://products.sanyodenki.com/media/document/sanups/H0033413_jp.pdf
https://products.sanyodenki.com/media/document/sanups/H0033449_en.pdf

Get alerted when CVE-2026-33253 or the next vulnerability affects your stack