CVE-2026-113363
CriticalCVSS 9.3Summary
Improper input validation in the network communication processing in NEC WebSAM WinShare versions 7.2.0 through 7.5.0, 7.6.0, and 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges via a crafted network packet sent to the computer running WinShare.
Risk Assessment
Critical vulnerability — an unauthenticated attacker can remotely execute arbitrary commands with SYSTEM privileges, risking full host compromise and lateral movement.
Recommendation
Immediately update WebSAM WinShare to a patched version or apply vendor-recommended mitigations; limit network exposure of the service and monitor for suspicious traffic.
Other vulnerabilities in NEC WebSAM WinShare
See all- CVE-2026-113362High
Improper access control in the installation folder of NEC WebSAM Winshare versions 7.5.0 and earlier (excluding 7.3.3), 7.6.0, and 7.7.0 through 7.7.1 on Windows allows a locally authenticated low-privileged attacker to execute arbitrary code with SYSTEM privileges via a crafted DLL loaded by a SYSTEM-level process.
- CVE-2026-113364Critical
Buffer overflow in the data receiving process in NEC WebSAM WinShare versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header.
Original NVD description (English source)
Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges via a crafted network packet sent to the computer on which WinShare is running.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS