Pupsman Installation Folder Permissions Allow Arbitrary Code Execution

Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installation folder, which results in arbitrary code execution with SYSTEM privilege

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Pupsman versions before 3.9.0 suffer from an incorrect default permissions vulnerability (CWE-276) that allows attackers to place malicious executables in the installation directory and execute them with SYSTEM-level privileges. This is a critical issue affecting any organization running vulnerable Pupsman installations, as it requires minimal attacker sophistication—simply dropping a file into an accessible folder—yet grants the highest privilege level available on Windows systems. The vulnerability is particularly dangerous because default installations may leave folders world-writable or insufficiently restricted, making this a post-installation configuration issue rather than a code flaw that users might patch through normal updates.

Casky's 224 mapped security skills detect the attack patterns behind this vulnerability by analyzing MITRE ATT&CK technique TA0004 (Privilege Escalation) through Claude AI's extended reasoning capabilities. Practitioners using Casky would identify suspicious indicators including: unauthorized executable files appearing in Pupsman installation directories, process execution chains originating from non-standard locations within the installation folder, and SYSTEM-privilege processes spawning from binaries not signed by the legitimate vendor. The platform's skill coverage enables detection of both the initial file placement (CWE-276 manifestation) and the downstream privilege escalation, allowing security teams to catch adversaries exploiting weak default permissions before malicious code achieves execution with administrative rights.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-57895.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-57895

Casky has 224 skills that investigate the attack patterns behind CVE-2026-57895. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn