SKYSEA Client View CVE-2026-68959

Q: What is the CVSS score of CVE-2026-68959?

CVE-2026-68959 has a CVSS 4.0 base score of 5.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-65310 MEDIUM

Path Traversal: '/../filedir' (CWE-25)

2026-08-25 jpcert

GHSA-qfm5-9x7m-99jm

RCE Path Traversal Microsoft Skysea Client View Skymec It Manager

5.8

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

5.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network vector because exploitation traverses UDP to remote systems; PR:L for required local Windows login; full scope change with arbitrary RCE on subsequent managed endpoints.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 25, 2026 - 07:41 vuln.today

Severity Changed

Aug 25, 2026 - 07:22 NVD

HIGH MEDIUM

CVSS changed

Aug 25, 2026 - 07:22 NVD

8.5 (HIGH) 5.8 (MEDIUM)

CVE Published

Aug 25, 2026 - 06:27 cve.org

MEDIUM 5.8

DescriptionCVE.org

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected products installed and can receive UDP packets from that system. Note that this vulnerability is due to an incomplete fix for CVE-2024-41726.

AnalysisAI

Path traversal in SKYSEA Client View and SKYMEC IT Manager enables a locally-authenticated Windows user to execute arbitrary code on remote Windows systems running the same software via UDP communication channels. This is an incomplete-fix bypass of CVE-2024-41726, reported by JPCERT/CC, meaning the original remediation failed to neutralize all traversal variants. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The attacker must hold a valid Windows user account and be able to log in interactively to a Windows system on which SKYSEA Client View or SKYMEC IT Manager is installed - this is the PR:L boundary. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 base score of 5.8 reflects meaningful constraints: AT:P (specific attack requirements - the target must be UDP-reachable from the attacker's managed workstation) and PR:L (requires a valid Windows login on the source system). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the vendor-released patch detailed in the official advisory at https://www.skyseaclientview.net/news/260824_01/. … Detailed patch versions, workarounds, and compensating controls in full report.