CVE-2026-82768

CVE-2026-82768 is a path traversal vulnerability (CWE-23) in SGA1000 that is reachable through the product's FTP interface. An attacker who can access the product via FTP — for example, an outsider with reachable FTP access or an insider holding valid FTP credentials — can use directory traversal sequences to escape the intended directory and view or alter arbitrary files on the server. Successful exploitation gives high confidentiality and integrity impact (files can be read and rewritten) with no direct availability impact, reflected in a CVSS v4.0 score of 8.6 (high). Organizations running SGA1000, especially deployments with the FTP service enabled and network-reachable, are affected; the specific affected version range was not stated in the advisory. No public proof-of-concept is known, the flaw is not on CISA's Known Exploited Vulnerabilities list, and there is no evidence of in-the-wild exploitation as of this writing.

What to do: Apply the patched version or firmware that the vendor's JPCERT/JVN advisory specifies for SGA1000 as soon as it is available. Until then, disable the FTP service if it is not required, or restrict it to trusted source addresses with strong, unique account credentials. Review the host's file integrity and FTP logs for anomalous traversal-style path requests or unexpected file modifications.