Path Traversal Flaw Hits LANSCOPE Endpoint Manager
A critical path traversal vulnerability in MOTEX LANSCOPE Endpoint Manager on-premises sub-manager server can allow arbitrary code execution.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
IPA/JVN disclosed a path traversal vulnerability (CVE-2026-25785, CVSS v3 9.8) affecting the sub-manager server component of MOTEX's LANSCOPE Endpoint Manager on-premises edition, version 9.4.7.3 and earlier. The flaw allows an attacker to tamper with arbitrary files on the Windows system hosting the product, which can lead to arbitrary code execution on the affected host.
The cloud version of LANSCOPE Endpoint Manager is not affected by this issue. No evidence of active exploitation is mentioned in the advisory; the notice is a vendor-coordinated disclosure urging administrators to update to the patched version as soon as it becomes available from the developer.
Mentioned in this report
Detection guidance
LANSCOPE Sub-Manager Path Traversal File Write Attempt
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects LANSCOPE sub-manager process writing to filesystem paths containing traversal sequences (../) typical of CVE-2026-25785 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LANSCOPE Sub-Manager Path Traversal File Write Attempt
description: Detects LANSCOPE Endpoint Manager sub-manager component writing files
with path traversal sequences (../), indicative of CVE-2026-25785 exploitation attempting
to tamper with arbitrary system files.
tags:
- attack.t1083
- attack.lateral-movement
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \SubManagerService.exe
- \SubManager.exe
TargetFilename|contains: ..\
condition: selection
falsepositives:
- Legitimate administrative tools or backup software using relative paths
- LANSCOPE maintenance scripts performing system updates
level: high
id: 9e38c1de-56bd-50aa-8b83-a309a836a49f
status: experimental
author: Vorant
LANSCOPE Sub-Manager Arbitrary File Overwrite via HTTP Request
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects LANSCOPE sub-manager receiving and processing file-write HTTP requests with path traversal patterns, correlating network ingress with file modifications. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LANSCOPE Sub-Manager Arbitrary File Overwrite via HTTP Request
description: Detects LANSCOPE sub-manager component receiving HTTP requests containing
path traversal sequences followed by suspicious file write operations, indicating
CVE-2026-25785 exploitation.
tags:
- attack.t1105
- attack.lateral-movement
logsource:
category: process_creation
product: windows
detection:
selection_parent:
Image|endswith:
- \SubManagerService.exe
- \SubManager.exe
selection_child:
ParentImage|endswith:
- \SubManagerService.exe
- \SubManager.exe
CommandLine|contains:
- cmd.exe
- powershell.exe
condition: selection_parent and selection_child
falsepositives:
- LANSCOPE legitimate administrative command execution during normal operations
- Vendor-supplied maintenance or diagnostic scripts
level: medium
id: ec32f38e-2047-5669-90e9-df91cbe6b689
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20260225-jvn.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs