EUVD-2026-65308
GHSA-w323-mx8p-gxh5
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector with low-privilege account sufficient; no scope change as impact is confined to the host; full C/I/A impact from SYSTEM execution.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
3DescriptionCVE.org
A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege.
AnalysisAI
Local privilege escalation to SYSTEM in SKYSEA Client View and SKYMEC IT Manager allows any authenticated Windows user to execute arbitrary code with SYSTEM-level privileges. The root cause is a missing authorization check (CWE-862) within one or more privileged components of these IT asset management products. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be logged in to the Windows system on which SKYSEA Client View or SKYMEC IT Manager is installed - confirmed by AV:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.5 with vector AV:L/AC:L/AT:N/PR:L/UI:N reflects a locally exploitable flaw requiring only a standard Windows user account with no special conditions or user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Organizations should consult the vendor advisory at https://www.skyseaclientview.net/news/260824_01/ and the JPCERT/JVN disclosure at https://jvn.jp/en/jp/JVN33423625/ for the patched version and upgrade instructions; exact fix version numbers were not independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all endpoints running SKYSEA Client View and SKYMEC IT Manager; simultaneously, audit and restrict local administrator access on affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Skysea Client View
View allPrivilege escalation to SYSTEM in SKYSEA Client View and SKYMEC IT Manager (Sky Co., Ltd.) affects any Windows host wher
Local privilege escalation in SKYSEA Client View (≤21.200.07j) and SKYMEC IT Manager (≤2024.005.10a) allows low-privileg
Origin validation error vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. Rated high severity (
Incorrect privilege assignment vulnerability exists in SKYSEA Client View Ver.6.010.06 to Ver.19.210.04e. Rated high sev
Improper access control vulnerability exists in the specific folder of SKYSEA Client View versions from Ver.16.100 prior
Untrusted search path vulnerability in the installer of SKYSEA Client View Ver.1.020.05b to Ver.16.001.01g allows an att
Privilege escalation vulnerability in SKYSEA Client View Ver.12.200.12n to 15.210.05f allows an attacker to obtain unaut
Path traversal vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. Rated high severity (CVSS 7.5)
Improper access control vulnerability exists in the resident process of SKYSEA Client View versions from Ver.11.220 prio
Path traversal in SKYSEA Client View and SKYMEC IT Manager enables a locally-authenticated Windows user to execute arbit
Lateral code execution via path traversal in SKYSEA Client View and SKYMEC IT Manager allows a low-privileged user authe
Stack-based buffer overflow in SKYSEA Client View and SKYMEC IT Manager (SKY Co., Ltd.) enables an authenticated attacke
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today