NEC WebSAM Winshare CVE-2026-113362

Requires a locally authenticated low-privileged account on a Windows host running WebSAM Winshare (affected: Ver 7.5.0 and earlier excluding 7.3.3, Ver 7.6.0, and Ver 7.7.0-7.7.1). The concrete prerequisite is improper access control (weak permissions) on the program installation folder that lets the low-privileged attacker write a crafted DLL into a location from which a SYSTEM-level process will load it (DLL hijacking). Limiting factors: no remote vector (AV:L) - the attacker must already have local access and valid low-privilege credentials (PR:L); exploitation also depends on a SYSTEM-level process actually loading the planted DLL. No user interaction is required (UI:N).

This is a credible local privilege-escalation issue rather than a remotely-wormable emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) describes a locally-exploitable flaw requiring an attacker to already hold a low-privileged authenticated session on the host, with low complexity, no special attack requirements, and no user interaction; vulnerable-system impact is High across confidentiality, integrity and availability because the payload runs as SYSTEM. The real-world signals are modest in breadth but serious in depth: the vuln.today decision label is 'this_week' (prioritize but not act-now/emergency), there is no CISA KEV listing, no EPSS score is supplied, and no public exploit is referenced - so there is no confirmed active exploitation. The single source is NEC's own PSIRT advisory (nv26-006), which is authoritative for the affected product. The weighing: raw severity is high (8.5) and the SYSTEM-level technical impact is total, but exploitation is gated behind prior local access to a niche enterprise product, so this is a strong local EoP for defenders who already run WebSAM Winshare, not a mass-exploitation priority. EPSS is missing, so widespread-exploitation probability cannot be quantified from the input.

An attacker who already has a low-privileged account on a Windows host running WebSAM Winshare takes advantage of weak permissions on the program installation folder (CWE-276) to drop a malicious DLL where a SYSTEM-level process will load it. When that process next loads the planted DLL, the attacker's code runs with SYSTEM privileges, giving full control of the machine. No public exploit is identified at time of analysis, and exploitation requires local access with low complexity and no user interaction.