Default Permission Flaw in Soliton Systems Products Allows Arbitrary Code Execution
CVE-2026-27653

5.4MEDIUM

Key Information:

Vendor

Soliton Systems K.k.

Status
Soliton Securebrowser For Onegate
Soliton Securebrowser Ii
Soliton Secureworkspace (formerly Wrappingbox)
Vendor
CVE Published:
27 February 2026

What is CVE-2026-27653?

Soliton Systems K.K. has identified a security issue in the installers for various products, where incorrect default permissions can lead to arbitrary code execution with SYSTEM privileges. This vulnerability potentially allows unauthorized users to execute malicious code, jeopardizing system integrity and confidentiality.

Affected Version(s)

Soliton SecureBrowser for OneGate V1.0.0

Soliton SecureBrowser II V2.0.0 to V2.0.14

Soliton SecureWorkspace (formerly WrappingBox) V1.0.0 to V1.4.7

References

https://www.soliton.co.jp/support/2026/006679.html
https://jvn.jp/en/jp/JVN41357120/

CVSS V4

Score:
5.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

CVSS V3.0

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.