CVE-2026-8108 Fuji Electric CVE debrief

Who should care

Organizations running Fuji Electric Tellus 5.0.2, especially industrial control or operations teams that install or maintain the software on shared or production systems. Security teams responsible for local privilege hardening and software deployment controls should also review this advisory.

Technical summary

The supplied advisory describes a kernel driver installed by Fuji Tellus that grants all users read and write permissions. The published CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a locally reachable issue requiring low privileges but with high impact if abused. CISA’s remediation notes specify that Fuji Electric recommends installing Tellus only with administrator privileges.

Defensive priority

High. The issue is locally exploitable, requires low privileges, and is rated HIGH with full confidentiality, integrity, and availability impact in the supplied scoring. Prioritize deployment restrictions and least-privilege controls on any affected systems.

Recommended defensive actions

• Confirm whether Fuji Electric Tellus 5.0.2 is installed anywhere in your environment.
• Restrict installation of Tellus to trusted administrative users only, as recommended in the advisory.
• Review local privilege and file-permission controls on affected hosts to reduce the impact of over-permissive drivers.
• If the product is required, place affected systems under enhanced monitoring for unexpected file or configuration changes.
• Validate the advisory and vendor guidance before making changes in production OT/ICS environments.

Evidence notes

All substantive claims here are taken from the supplied CISA CSAF source item and its metadata: the product is Fuji Electric Tellus 5.0.2, the advisory describes a kernel driver granting all users read/write permissions, and the remediation says installation should be limited to administrator privileges. The published date used for timing context is 2026-05-12. No KEV entry is present in the supplied enrichment data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.