The installer of RATOC RAID Monitoring Manager for Windows searches the current directory to load certain DLLs

CVE-2026-28760 is an insecure DLL search-path issue in the installer for RATOC RAID Monitoring Manager for Windows, mapped to CWE-427. The affected range is versions prior to 2.00.009.260220; the fix is the vendor's updated installer at 2.00.009.260220. If a crafted DLL is placed in the installer's current working directory and the installer is then launched, Windows can load the attacker's DLL and execute code with the installer's elevated privileges.

The vendor's HIGH 7.8 score reflects the eventual impact correctly, but it overstates enterprise urgency. This is not a remotely reachable service flaw; it is an installer-time local execution problem that depends on user interaction, a writable/untrusted working directory, and someone actually running this niche hardware utility installer. In real fleets, those compounded prerequisites crush the exposed population.

Why this verdict

• Downgrade for attacker position: the path is effectively *local installer execution*, not unauthenticated remote compromise. That alone strips most of the urgency out of a 7.8 label.
• Downgrade for exposure population: this affects a niche RAID enclosure utility tied to specific RATOC hardware, not a common enterprise platform. Even inside Windows fleets, only a tiny subset will ever have this installer in play.
• Downgrade for timing and workflow dependency: exploitation happens during install/upgrade time and requires the victim to run from an untrusted directory. Modern software deployment, trusted package repos, EDR, SmartScreen, and user friction all compound against attackers.

Why not higher?

There is no evidence of KEV listing, public exploitation, or a commodity exploit ecosystem. More importantly, this is not a service that sits there waiting to be hit; the vulnerable condition exists only when the installer is invoked from the wrong place.

Why not lower?

If the exploit chain lands, the attacker gets administrator-level code execution, which is not trivial impact. Enterprises that still allow manual installs from Downloads, ZIP extractions, or SMB shares can absolutely trip over this, especially on admin workstations or lab systems.

1. Force installs from trusted paths only — Restrict RATOC installer execution to your software distribution system or a signed internal repository, and block ad hoc execution from %Downloads%, temp paths, removable media, and writable SMB shares. For a LOW verdict there is no formal mitigation SLA; treat this as backlog hygiene and fold the control into normal Windows hardening.
2. Block unsigned DLL loads from user-writeable directories — Use WDAC/AppLocker/EDR policy to deny or alert on installers loading unsigned DLLs from the same directory or other user-writeable locations. This directly attacks the hijack primitive and is more useful than chasing the CVE with network scanners.
3. Watch for installer execution in bad places — Create detections for the vendor MSI or msiexec.exe starting from user profiles, temp directories, ZIP extraction folders, or network shares. This is the control most likely to catch real abuse before the payload pivots.
4. Package the fixed installer centrally — Publish only the vendor-fixed 2.00.009.260220 installer in your approved software catalog and retire older copies from shares and technician toolkits. For a LOW issue, do this as routine image/package maintenance rather than as an emergency campaign.

Run this on the target Windows host or through your endpoint management platform. Invoke with powershell.exe -ExecutionPolicy Bypass -File .\check-ratoc-cve-2026-28760.ps1; standard user rights are usually enough to read uninstall inventory, but admin helps if you also want to inspect install locations.

# check-ratoc-cve-2026-28760.ps1

# Detects whether RATOC RAID Monitoring Manager for Windows is present

# and whether the installed DisplayVersion indicates a vulnerable build.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'

function Get-RatocInstall {
    $roots = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    foreach ($root in $roots) {
        Get-ItemProperty $root | Where-Object {
            $_.DisplayName -match 'RATOC RAID' -or $_.DisplayName -match 'RAID Monitoring Manager'
        } | ForEach-Object {
            [PSCustomObject]@{
                DisplayName     = $_.DisplayName
                DisplayVersion  = $_.DisplayVersion
                Publisher       = $_.Publisher
                InstallLocation = $_.InstallLocation
                UninstallString = $_.UninstallString
                PSPath          = $_.PSPath
            }
        }
    }
}

function Normalize-Version([string]$v) {
    if ([string]::IsNullOrWhiteSpace($v)) { return $null }
    $digits = ($v -replace '[^0-9]', '')
    if ([string]::IsNullOrWhiteSpace($digits)) { return $null }
    return [Int64]$digits
}

$fixedVersionRaw = '2.00.009.260220'
$fixedVersionNum = Normalize-Version $fixedVersionRaw
$installs = @(Get-RatocInstall)

if ($installs.Count -eq 0) {
    Write-Output 'UNKNOWN - RATOC RAID Monitoring Manager not found in uninstall inventory on this host.'
    exit 2
}

# If multiple entries exist, evaluate the newest parsable version

$evaluated = @()
foreach ($app in $installs) {
    $num = Normalize-Version $app.DisplayVersion
    $evaluated += [PSCustomObject]@{
        DisplayName     = $app.DisplayName
        DisplayVersion  = $app.DisplayVersion
        VersionNum      = $num
        InstallLocation = $app.InstallLocation
    }
}

$parsable = $evaluated | Where-Object { $_.VersionNum -ne $null } | Sort-Object VersionNum -Descending

if ($parsable.Count -eq 0) {
    Write-Output 'UNKNOWN - RATOC app found, but DisplayVersion is missing or unparsable.'
    $evaluated | ForEach-Object { Write-Output ("Found: {0} | Version: {1}" -f $_.DisplayName, $_.DisplayVersion) }
    exit 2
}

$best = $parsable[0]

if ($best.VersionNum -lt $fixedVersionNum) {
    Write-Output ("VULNERABLE - {0} version {1} is older than fixed version {2}." -f $best.DisplayName, $best.DisplayVersion, $fixedVersionRaw)
    exit 1
}
elseif ($best.VersionNum -ge $fixedVersionNum) {
    Write-Output ("PATCHED - {0} version {1} meets or exceeds fixed version {2}." -f $best.DisplayName, $best.DisplayVersion, $fixedVersionRaw)
    exit 0
}
else {
    Write-Output 'UNKNOWN - Unable to determine patch state.'
    exit 2
}

Sources

1. NVD CVE-2026-28760
2. JVN#08057419 advisory
3. RATOC vendor advisory
4. RATOC download / fixed installer page
5. CWE-427 definition
6. JVNTA on insecure DLL loading in Windows apps
7. CISA Known Exploited Vulnerabilities catalog
8. FIRST EPSS