MOTEX LANSCOPE path traversal enables arbitrary code execution
MOTEX LANSCOPE Endpoint Manager on-premises suffers a critical path-traversal flaw (CVE-2026-25785, CVSS 9.8) enabling arbitrary file modification and code execution.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Japan's IPA has disclosed a critical path-traversal vulnerability in MOTEX Corporation's LANSCOPE Endpoint Manager on-premises edition, affecting sub-manager server versions 9.4.7.3 and earlier. The flaw permits an attacker to modify arbitrary files on the underlying Windows system, leading to arbitrary code execution. The cloud version of LANSCOPE Endpoint Manager is not affected. MOTEX has released patches, and organizations running the affected product should update immediately to the latest version. Given the CVSS 9.8 score and the nature of the vulnerability—arbitrary code execution on endpoint-management infrastructure—this represents a serious supply-chain risk for any enterprise relying on the product for fleet management.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by LANSCOPE Endpoint Manager Service
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a command interpreter (cmd/powershell/wscript) spawned by the LANSCOPE Endpoint Manager sub-manager server process, consistent with post-exploitation of the CVE path-traversal/RCE flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LANSCOPE Endpoint Manager Spawning Command Interpreter
id: 54f6e036-d60f-5ec2-b257-5fb067624bfb
status: experimental
description: Detects cmd.exe, powershell.exe, wscript.exe or mshta.exe being spawned
with a parent process located in a LANSCOPE / MOTEX Endpoint Manager installation
directory, which may indicate exploitation of the LANSCOPE Endpoint Manager sub-manager
path-traversal vulnerability (CVE affecting versions <= 9.4.7.3) leading to arbitrary
code execution.
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- \LANSCOPE\
- \MOTEX\
- MCSMgr
- MCSAgent
- MCSClient
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate administrative scripts or agent update routines launched by the LANSCOPE
service during normal patching/maintenance
- Custom automation integrated with the endpoint management console
level: high
tags:
- attack.t1059
- attack.execution
author: Vorant
Executable or Script File Dropped in LANSCOPE Endpoint Manager Web/Install Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of executable or script files inside the LANSCOPE Endpoint Manager sub-manager installation/web directory, which may indicate a path-traversal write used to plant a webshell or payload as part of the disclosed CVE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: File Write Into LANSCOPE Endpoint Manager Install Directory
id: 2d91b5ce-18bb-5984-af4b-c56232559a25
status: experimental
description: Detects creation of script or executable files (.aspx, .jsp, .php, .exe,
.dll, .ps1, .bat) within a LANSCOPE / MOTEX Endpoint Manager sub-manager server
directory, consistent with exploitation of the path-traversal vulnerability to drop
code for later execution.
logsource:
category: file_event
product: windows
detection:
selection_path:
TargetFilename|contains:
- \LANSCOPE\
- \MOTEX\
selection_ext:
TargetFilename|endswith:
- .aspx
- .jsp
- .php
- .exe
- .dll
- .ps1
- .bat
condition: selection_path and selection_ext
falsepositives:
- Legitimate product update or patch installation writing new binaries into the same
directory tree
- Administrator-deployed custom scripts stored alongside the application for scheduled
maintenance
level: medium
tags:
- attack.t1059
- attack.execution
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20260225-jvn.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs