CVE-2026-113362
HighCVSS 8.5Summary
Improper access control in the installation folder of NEC WebSAM Winshare versions 7.5.0 and earlier (excluding 7.3.3), 7.6.0, and 7.7.0 through 7.7.1 on Windows allows a locally authenticated low-privileged attacker to execute arbitrary code with SYSTEM privileges via a crafted DLL loaded by a SYSTEM-level process.
Risk Assessment
A local low-privileged attacker could escalate privileges to SYSTEM and gain full control of the system. This poses a serious threat to confidentiality, integrity, and availability.
Recommendation
Update WebSAM Winshare to a patched version or apply a workaround by restricting write permissions to the installation folder. Also verify that no unauthorized DLL files are present in the folder.
Other vulnerabilities in NEC WebSAM Winshare
See all- CVE-2026-113364Critical
Buffer overflow in the data receiving process in NEC WebSAM WinShare versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header.
- CVE-2026-113363Critical
Improper input validation in the network communication processing in NEC WebSAM WinShare versions 7.2.0 through 7.5.0, 7.6.0, and 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges via a crafted network packet sent to the computer running WinShare.
Original NVD description (English source)
Improper Access Control in the program installation folder in NEC Corporation WebSAM Winshare Ver 7.5.0 and earlier (excluding Ver 7.3.3), Ver 7.6.0 and Ver 7.7.0 through 7.7.1 on Windows allows a locally authenticated low-privileged attacker to execute arbitrary code with SYSTEM privileges via a crafted DLL file that is loaded by a SYSTEM-level process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS