MOTEX LANSCOPE Endpoint Manager on-premises suffers a critical path-traversal flaw…

24 February 2026 critical vulnerability

MOTEX LANSCOPE Endpoint Manager on-premises suffers a critical path-traversal flaw (CVE-2026-25785, CVSS 9.8) enabling arbitrary file modification and code execution.

Japan's IPA has disclosed a critical path-traversal vulnerability in MOTEX Corporation's LANSCOPE Endpoint Manager on-premises edition, affecting sub-manager server versions 9.4.7.3 and earlier. The flaw permits an attacker to modify arbitrary files on the underlying Windows system, leading to arbitrary code execution. The cloud version of LANSCOPE Endpoint Manager is not affected. MOTEX has released patches, and organizations running the affected product should update immediately to the latest version. Given the CVSS 9.8 score and the nature of the vulnerability—arbitrary code execution on endpoint-management infrastructure—this represents a serious supply-chain risk for any enterprise relying on the product for fleet management.

Mentioned in this report

Vulnerabilities CVE-2026-25785

Detection guidance

Suspicious Child Process Spawned by LANSCOPE Endpoint Manager Service

ATT&CK T1059

Detects a command interpreter (cmd/powershell/wscript) spawned by the LANSCOPE Endpoint Manager sub-manager server process, consistent with post-exploitation of the CVE path-traversal/RCE flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: LANSCOPE Endpoint Manager Spawning Command Interpreter
id: 54f6e036-d60f-5ec2-b257-5fb067624bfb
status: experimental
description: Detects cmd.exe, powershell.exe, wscript.exe or mshta.exe being spawned
  with a parent process located in a LANSCOPE / MOTEX Endpoint Manager installation
  directory, which may indicate exploitation of the LANSCOPE Endpoint Manager sub-manager
  path-traversal vulnerability (CVE affecting versions <= 9.4.7.3) leading to arbitrary
  code execution.
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - \LANSCOPE\
    - \MOTEX\
    - MCSMgr
    - MCSAgent
    - MCSClient
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate administrative scripts or agent update routines launched by the LANSCOPE
  service during normal patching/maintenance
- Custom automation integrated with the endpoint management console
level: high
tags:
- attack.t1059
- attack.execution
author: Vorant

Executable or Script File Dropped in LANSCOPE Endpoint Manager Web/Install Directory

ATT&CK T1059

Detects creation of executable or script files inside the LANSCOPE Endpoint Manager sub-manager installation/web directory, which may indicate a path-traversal write used to plant a webshell or payload as part of the disclosed CVE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: File Write Into LANSCOPE Endpoint Manager Install Directory
id: 2d91b5ce-18bb-5984-af4b-c56232559a25
status: experimental
description: Detects creation of script or executable files (.aspx, .jsp, .php, .exe,
  .dll, .ps1, .bat) within a LANSCOPE / MOTEX Endpoint Manager sub-manager server
  directory, consistent with exploitation of the path-traversal vulnerability to drop
  code for later execution.
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
    - \LANSCOPE\
    - \MOTEX\
  selection_ext:
    TargetFilename|endswith:
    - .aspx
    - .jsp
    - .php
    - .exe
    - .dll
    - .ps1
    - .bat
  condition: selection_path and selection_ext
falsepositives:
- Legitimate product update or patch installation writing new binaries into the same
  directory tree
- Administrator-deployed custom scripts stored alongside the application for scheduled
  maintenance
level: medium
tags:
- attack.t1059
- attack.execution
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20260225-jvn.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free