CVE-2026-21408
Unknown Unknown - Not Provided
DLL Search Path Vulnerability in beat-access Allows SYSTEM Code Execution

Publication date: 2026-01-27

Last updated on: 2026-01-27

Assigner: JPCERT/CC

Description
beat-access for Windows version 3.0.3 and prior contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with SYSTEM privileges.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-27
Last Modified
2026-01-27
Generated
2026-06-16
AI Q&A
2026-01-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-21408
EUVD
EUVD-2026-4755
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
fujifilm_business_innovation_corp beat-access to 3.0.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-427 The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in beat-access for Windows (version 3.0.3 and earlier) involves an uncontrolled search path element (CWE-427) that causes the software to insecurely load Dynamic Link Libraries (DLLs). This flaw can allow an attacker to execute arbitrary code with SYSTEM privileges if the software is installed outside the default installation folder. [1, 2]

Impact Analysis

The vulnerability can lead to arbitrary code execution with SYSTEM privileges, which means an attacker could gain high-level control over the affected system. This represents a significant risk of privilege escalation, potentially compromising confidentiality, integrity, and availability of the system. However, exploitation requires local access and some user interaction, and no exploitation has been reported so far. [1, 2]

Detection Guidance

You can detect this vulnerability by verifying the installed version of beat-access for Windows. Launch the beat-access application, then select "γƒ˜γƒ«γƒ—οΌˆHοΌ‰" (Help) and "γƒγƒΌγ‚Έγƒ§γƒ³ζƒ…ε ±οΌˆAοΌ‰" (About) to check the version number displayed beneath the software name. If the version is 3.0.3 or earlier, the system is vulnerable. There are no specific network or system commands provided for detection in the resources. [1]

Mitigation Strategies

To mitigate this vulnerability, immediately update beat-access for Windows to version 4.0.0 or later. Additionally, ensure that the software is installed in the default installation folder, as no impact occurs if installed there. The latest version can be downloaded internally via the beat-box LAN or externally through the Remote Access Support Page provided by FUJIFILM Business Innovation Corp. [1, 2]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-21408. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart