SKYSEA Client View CVE-2026-66109

Exploitation requires the attacker to be logged in to the Windows system on which SKYSEA Client View or SKYMEC IT Manager is installed - confirmed by AV:L in the CVSS vector. Only a standard (low-privilege) Windows user account is needed (PR:L); no administrative rights are required. No user interaction from another party is needed (UI:N), and no non-default configuration is indicated as a prerequisite (AT:N). Exploitation is therefore limited to local access scenarios: an attacker must already have gained a foothold on the affected Windows endpoint, either via credential compromise, physical access, or prior exploitation of another vulnerability. Remote unauthenticated exploitation is not possible. The attack is not limited to specific SKYSEA features being enabled - the missing authorization flaw applies to the base installation.

The CVSS 4.0 score of 8.5 with vector AV:L/AC:L/AT:N/PR:L/UI:N reflects a locally exploitable flaw requiring only a standard Windows user account with no special conditions or user interaction. The high C/I/A impact scores confirm full SYSTEM-level compromise of the vulnerable host. The attack complexity is low and no attack requirements apply (AT:N), meaning reliable exploitation is straightforward once an attacker has a foothold. EPSS data was not provided, limiting probability-of-exploitation estimation. No KEV listing and no public POC are confirmed, suggesting exploitation has not been observed in the wild at time of analysis. Despite the absence of public exploitation, the combination of low-privilege local access, no interaction requirement, and complete SYSTEM takeover makes this a genuine priority for organizations running SKYSEA Client View or SKYMEC IT Manager on Windows systems accessible to untrusted or semi-trusted users (e.g., shared workstations, VDI environments, or systems with multiple accounts). The risk is bounded by the requirement for local authentication - remote unauthenticated exploitation is not possible based on AV:L.

An attacker who has obtained a low-privilege Windows user account - for example, through credential phishing or lateral movement onto a managed endpoint - identifies that SKYSEA Client View is installed. By invoking an improperly guarded local interface (such as a named pipe or local RPC endpoint) exposed by a SYSTEM-privileged SKYSEA service, the attacker triggers execution of attacker-controlled code without any authorization validation, achieving immediate SYSTEM-level access on the host. No public exploit code has been identified at time of analysis, but the low complexity (AC:L, AT:N) suggests reliable exploitation is achievable by a skilled attacker without specialized tooling.