SKYSEA Client View CVE-2026-69665

Exploitation requires an authenticated Windows logon session - local interactive, RDP, or equivalent - on the specific host where SKYSEA Client View or SKYMEC IT Manager is installed; the CVSS PR:L metric confirms standard non-administrative user credentials are sufficient. The vulnerability is inherent to the default installation state of the affected product and does not require any special non-default configuration to be enabled. What limits exploitation is strictly the local attack vector (AV:L): an attacker without any existing authenticated session on the target host cannot exploit this remotely. Shared workstation environments, VDI pools, and Windows servers where multiple standard-user accounts can log on interactively represent the highest-risk deployment scenarios. Hosts accessible only to administrators are effectively unexploitable by this vector.

The CVSS 4.0 score of 8.5 accurately reflects the impact profile: once an attacker holds a local session, there are no complexity barriers (AC:L, AT:N) and no user interaction dependency (UI:N), yielding full high confidentiality, integrity, and availability impact on the vulnerable system. The critical limiting factor is the local attack vector (AV:L) with low-privilege requirement (PR:L) - remote unauthenticated exploitation is not possible, and the attacker must first obtain authenticated access to the specific Windows host running SKYSEA or SKYMEC. No KEV listing is present in the input data, and no public POC is confirmed; EPSS data was not provided and exploitation probability cannot be independently assessed. The absence of confirmed active exploitation and the local-only attack vector meaningfully reduce real-world blast radius compared to network-exploitable privilege escalation flaws of equivalent CVSS score. Priority should be highest for organizations with shared Windows workstations, VDI deployments, or environments where untrusted or semi-trusted users can authenticate to hosts running these agents.

An authenticated standard Windows user on a host running SKYSEA Client View identifies that one or more files or directories associated with the product's SYSTEM-level service are writable by the current user account due to incorrect default installation permissions. The attacker replaces a service binary or plants a malicious DLL in a search-order-hijackable path, then waits for or triggers a service restart, causing the SYSTEM-privileged service to execute the attacker-controlled code. No public exploit code is confirmed at time of analysis, but the AC:L/AT:N metrics indicate no specialized tooling or race conditions are required.