Path Traversal Flaw Hits LANSCOPE Endpoint Manager
A critical path traversal vulnerability in MOTEX LANSCOPE Endpoint Manager on-premises sub-manager server can allow arbitrary code execution.
IPA/JVN disclosed a path traversal vulnerability (CVE-2026-25785, CVSS v3 9.8) affecting the sub-manager server component of MOTEX's LANSCOPE Endpoint Manager on-premises edition, version 9.4.7.3 and earlier. The flaw allows an attacker to tamper with arbitrary files on the Windows system hosting the product, which can lead to arbitrary code execution on the affected host.
The cloud version of LANSCOPE Endpoint Manager is not affected by this issue. No evidence of active exploitation is mentioned in the advisory; the notice is a vendor-coordinated disclosure urging administrators to update to the patched version as soon as it becomes available from the developer.
Mentioned in this report
Detection guidance
LANSCOPE Sub-Manager Path Traversal File Write Attempt
Detects LANSCOPE sub-manager process writing to filesystem paths containing traversal sequences (../) typical of CVE-2026-25785 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LANSCOPE Sub-Manager Path Traversal File Write Attempt
description: Detects LANSCOPE Endpoint Manager sub-manager component writing files
with path traversal sequences (../), indicative of CVE-2026-25785 exploitation attempting
to tamper with arbitrary system files.
tags:
- attack.t1083
- attack.lateral-movement
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \SubManagerService.exe
- \SubManager.exe
TargetFilename|contains: ..\
condition: selection
falsepositives:
- Legitimate administrative tools or backup software using relative paths
- LANSCOPE maintenance scripts performing system updates
level: high
id: 9e38c1de-56bd-50aa-8b83-a309a836a49f
status: experimental
author: Vorant
LANSCOPE Sub-Manager Arbitrary File Overwrite via HTTP Request
Detects LANSCOPE sub-manager receiving and processing file-write HTTP requests with path traversal patterns, correlating network ingress with file modifications. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LANSCOPE Sub-Manager Arbitrary File Overwrite via HTTP Request
description: Detects LANSCOPE sub-manager component receiving HTTP requests containing
path traversal sequences followed by suspicious file write operations, indicating
CVE-2026-25785 exploitation.
tags:
- attack.t1105
- attack.lateral-movement
logsource:
category: process_creation
product: windows
detection:
selection_parent:
Image|endswith:
- \SubManagerService.exe
- \SubManager.exe
selection_child:
ParentImage|endswith:
- \SubManagerService.exe
- \SubManager.exe
CommandLine|contains:
- cmd.exe
- powershell.exe
condition: selection_parent and selection_child
falsepositives:
- LANSCOPE legitimate administrative command execution during normal operations
- Vendor-supplied maintenance or diagnostic scripts
level: medium
id: ec32f38e-2047-5669-90e9-df91cbe6b689
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20260225-jvn.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free