WebSAM WinShare CVE-2026-113363

No special conditions beyond network reachability - remote unauthenticated exploitation of the WinShare network communication service against affected versions (WebSAM WinShare 7.2.0 through 7.5.0, 7.6.0, and 7.7.0 through 7.7.2 on Windows). The attacker only needs to send a crafted packet to the port on which the WinShare service listens; no credentials, no user interaction, and no non-default configuration are indicated by the vector (PR:N/UI:N/AC:L/AT:N). The primary limiting factor is network exposure: risk is sharply reduced if the WinShare listening port is not reachable from untrusted networks (e.g., firewalled or restricted to a management segment), and only the listed version ranges on Windows are affected. The exact mechanism of the improper input validation is not described in the available sources.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes the worst-case exposure: network-reachable, low attack complexity, no attack requirements, and no privileges or user interaction needed, with high confidentiality, integrity and availability impact on the vulnerable system (VC:H/VI:H/VA:H). The description reinforces this - a remote unauthenticated attacker achieves arbitrary command execution at SYSTEM level via a single crafted network packet, which is the maximum-severity outcome for a Windows service. The vuln.today decision label is 'act_now', consistent with the 9.3 score. However, several corroborating signals are MISSING rather than conflicting: there is no EPSS score in the input, no CISA KEV listing, and no PoC or exploit reference beyond the NEC vendor advisory. So while the intrinsic severity and the trigger prerequisites all point to high risk, there is currently no evidence of in-the-wild exploitation or public exploit code - the urgency rests on exploitability potential and the vendor/priority labeling, not on observed attacks. Treat as urgent to patch, but note that active-exploitation claims cannot be substantiated from the provided data.

An attacker with network reachability to a host running WebSAM WinShare sends a single crafted network packet to the service's listening port. Because input validation in the network communication processing is improper, the packet is parsed in a way that lets the attacker run arbitrary commands in the context of the WinShare service, which runs as SYSTEM. No authentication, credentials, or user interaction are required (AV:N/PR:N/UI:N); no public exploit code was identified at the time of analysis.