Skip to main content

SKYSEA Client View CVE-2026-68960

| EUVDEUVD-2026-65307 MEDIUM
Stack-based Buffer Overflow (CWE-121)
2026-08-25 jpcert GHSA-g35g-c954-r7h2
RCE Stack Overflow Buffer Overflow Microsoft Skysea Client View Skymec It Manager
5.8
CVSS 4.0 · Vendor: jpcert
Share

Severity by source

Vendor (jpcert) PRIMARY
5.8 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.5 HIGH

Network UDP delivery but AT:P conditions map to AC:H; authenticated local access required (PR:L); full RCE on a separate system constitutes scope change (S:C/C:H/I:H/A:H).

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Analysis Generated
Aug 25, 2026 - 07:39 vuln.today
Severity Changed
Aug 25, 2026 - 07:22 NVD
HIGH MEDIUM
CVSS changed
Aug 25, 2026 - 07:22 NVD
8.5 (HIGH) 5.8 (MEDIUM)
CVE Published
Aug 25, 2026 - 06:27 cve.org
MEDIUM 5.8

DescriptionCVE.org

A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected product installed and can receive UDP packets from that system.

AnalysisAI

Stack-based buffer overflow in SKYSEA Client View and SKYMEC IT Manager (SKY Co., Ltd.) enables an authenticated attacker to remotely execute arbitrary code on other Windows hosts running the same software via crafted UDP packets. The vulnerability functions as a lateral movement primitive: an attacker who has already obtained a login on one managed endpoint can exploit the product's UDP listener on any other reachable managed host, without requiring further interaction from the target. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold a valid local or domain account permitting login to a Windows system with SKYSEA Client View or SKYMEC IT Manager installed (PR:L per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.8 reflects an asymmetric threat model: the attack vector is Network (AV:N) and privileges are low (PR:L), but the attack requirement flag AT:P indicates that specific environmental conditions - authenticated access to one managed host plus UDP reachability to another - must both be satisfied. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the vendor-released patch as described at https://www.skyseaclientview.net/news/260824_01/ - the exact fixed version number must be confirmed from that advisory, as no specific patched release version was independently confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Skysea Client View

View all
CVE-2026-66109 HIGH
8.5 Aug 25

Local privilege escalation to SYSTEM in SKYSEA Client View and SKYMEC IT Manager allows any authenticated Windows user t
CVE-2026-69665 HIGH
8.5 Aug 25

Privilege escalation to SYSTEM in SKYSEA Client View and SKYMEC IT Manager (Sky Co., Ltd.) affects any Windows host wher
CVE-2026-39454 HIGH
8.5 Apr 20

Local privilege escalation in SKYSEA Client View (≤21.200.07j) and SKYMEC IT Manager (≤2024.005.10a) allows low-privileg
CVE-2024-41143 HIGH
7.8 Jul 29

Origin validation error vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. Rated high severity (
CVE-2024-41139 HIGH
7.8 Jul 29

Incorrect privilege assignment vulnerability exists in SKYSEA Client View Ver.6.010.06 to Ver.19.210.04e. Rated high sev
CVE-2024-21805 HIGH
7.8 Mar 12

Improper access control vulnerability exists in the specific folder of SKYSEA Client View versions from Ver.16.100 prior
CVE-2021-20616 HIGH
7.8 Jan 13

Untrusted search path vulnerability in the installer of SKYSEA Client View Ver.1.020.05b to Ver.16.001.01g allows an att
CVE-2020-5617 HIGH
7.8 Aug 04

Privilege escalation vulnerability in SKYSEA Client View Ver.12.200.12n to 15.210.05f allows an attacker to obtain unaut
CVE-2024-41726 HIGH
7.5 Jul 29

Path traversal vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. Rated high severity (CVSS 7.5)
CVE-2024-24964 MEDIUM
6.3 Mar 12

Improper access control vulnerability exists in the resident process of SKYSEA Client View versions from Ver.11.220 prio
CVE-2026-68959 MEDIUM
5.8 Aug 25

Path traversal in SKYSEA Client View and SKYMEC IT Manager enables a locally-authenticated Windows user to execute arbit
CVE-2026-68062 MEDIUM
5.8 Aug 25

Lateral code execution via path traversal in SKYSEA Client View and SKYMEC IT Manager allows a low-privileged user authe

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Share

CVE-2026-68960 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy