[Japanese]

JVNDB-2026-000028

Installer for Job log aggregation/analysis software RICOH Job Log Aggregation Tool may insecurely load Dynamic Link Libraries

Overview

The installer for Job log aggregation/analysis software RICOH Job Log Aggregation Tool contains the following vulnerability related to the DLL search path, which may lead to insecurely loading Dynamic Link Libraries.
  • Uncontrolled search path element (CWE-427) - CVE-2026-26050
Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 7.8 (High) [IPA Score]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
Affected Products


Ricoh Co., Ltd
  • Job log aggregation/analysis software RICOH Job Log Aggregation Tool versions prior to Ver.1.3.7

This product is sold only in Japan and does not have an official English name.
Impact

Arbitrary code may be executed with administrative privileges.
Solution

[Use the latest installer]
Use the latest installer provided by the developer.
Vendor Information

Ricoh Co., Ltd
CWE (What is CWE?)

  1. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2026-26050
References

  1. JVN : JVNTA#91240916
  2. JVN : JVN#69531868
Revision History

  • [2026/02/20]
      Web page was published

Date Public2026/02/20
Date First Published2026/02/20
Date Last Updated2026/02/20