AssetView flaw lets a logged-in Windows user gain SYSTEM rights

AssetView flaw lets a logged-in Windows user gain SYSTEM rights

13 October 2026: Hammock has fixed CVE-2026-101020 in AssetView, its IT asset and endpoint management suite, a flaw that lets anyone who can log in to a Windows machine running the management console or the client module replace programs that run with SYSTEM rights and so take full control of that machine. JPCERT/CC scores it 8.5 under CVSS 4.0 and 7.8 under CVSS 3.0, and Hammock says there is no workaround.

AssetView is sold mainly in Japan, where Hammock lists local governments, boards of education, schools, law firms, carmakers, financial firms, hospitals and builders among the sectors it serves. Its client module runs on every managed PC, which is what makes a local privilege flaw in it a fleet-wide concern.

How the flaw works

The weakness is an improper permission assignment on a critical resource (CWE-732). Programs that AssetView runs as SYSTEM are not protected well enough, so a user with ordinary rights can swap one of them for a program of their own. The next time it runs, the attacker's code runs as SYSTEM. Hammock's advisory spells out the consequences in plain terms: access to other users' data and system areas, tampering with system files, settings and security controls, and the risk of the product stopping for good.

The attack is local and needs a low-privilege login, with no user interaction. On shared PCs, school machines and terminal servers, that is a short list of preconditions.

Fixed versions

• AssetView (on-premises): fixed in 13.2.7B
• AssetView CLOUD, 13.2 line: fixed in 13.2.7B
• AssetView CLOUD, 13.3 line: fixed in 13.3.7
• AssetView Cloud +: fixed in client version 2600.201.11, released on 28 September

Customers with a maintenance contract download the patch or the fixed version and its manual from Hammock's maintenance site. Hammock notes that versions earlier than 13.2.0 are out of maintenance and cannot be upgraded straight to a fixed release; those customers have to contact its support group, and customers whose contract has lapsed go through its sales team. The version in use is shown in the window title of the management console.

Who found it

Satoru Nagaoka of Cyber Defense Institute reported the flaw to IPA under Japan's early warning partnership, and JPCERT/CC coordinated with Hammock. Neither the vendor nor JVN says the flaw has been exploited.

IT asset management in our catalogue

Our IT asset management software category lists five products, among them GLPI and InvGate IT Asset Management. AssetView was not listed before this advisory; its maker now has a profile.

Company profile on TrustList: Hammock

Related on TrustList:

• Apple will limit Rosetta to older games from macOS 28 onwards

Sources

• Hammock: JVN#38664315, privilege escalation vulnerability in AssetView (Japanese), 13 October 2026
• JVN (JPCERT/CC and IPA): JVN#38664315, improper permission assignment in AssetView (Japanese), 13 October 2026