Which versions of ExpressUpdate Agent are affected by CVE-2026-8797?

NEC's ExpressUpdate Agent for Windows contains a local privilege escalation vulnerability (CVE-2026-8797, CVSS 8.5) that allows any user with local system access to execute arbitrary code with SYSTEM…

How to fix or mitigate CVE-2026-8797?

Within 24 hours: Identify all Windows systems with NEC ExpressUpdate Agent installed and document current user provisioning and local administrator assignments. Within 7 days: Restrict file system and registry permissions on agent binaries (default: C:\Program Files\NEC\ExpressUpdate\), disable the agent service if operationally feasible, implement application control policies to block non-administrative execution, and enable Windows Security Event Log monitoring for privilege escalation attempts. Within 30 days: Establish direct engagement with NEC regarding CVE-2026-8797 patch timeline; evaluate alternative agent deployment or update mechanisms; conduct access control audit for all affected systems.

ExpressUpdate Agent CVE-2026-8797

Q: What is the CVSS score of CVE-2026-8797?

CVE-2026-8797 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-39623 HIGH

Exposed IOCTL with Insufficient Access Control (CWE-782)

2026-06-26 NEC

GHSA-cxm7-54mf-pwwg

RCE Microsoft Expressupdate Agent For Windows Nec Corporation

8.5

CVSS 4.0 · Vendor: NEC

Severity by source

Vendor (NEC) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local elevation by an already-present low-privileged user (AV:L/PR:L/AC:L), no interaction, yielding full SYSTEM control of the host so C/I/A:H with unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (NEC).

CVSS VectorVendor: NEC

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 05:15 vuln.today

CVE Published

Jun 26, 2026 - 04:14 cve.org

HIGH 8.5

DescriptionCVE.org

An access control deficiency vulnerability exists in ExpressUpdate Agent for Windows. If a malicious user gains access to the product, arbitrary code could be executed with SYSTEM privileges.

AnalysisAI

Local privilege escalation in NEC's ExpressUpdate Agent for Windows allows a low-privileged user who can already access the host to execute arbitrary code with SYSTEM privileges, owing to insufficient access controls on the agent. Reported by NEC under advisory NV26-004, the flaw carries a CVSS 4.0 base score of 8.5 (High) and maps to CWE-782 (exposed IOCTL with insufficient access control). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

ExpressUpdate Agent is NEC management software that runs on Windows servers (notably the NEC Express5800 line) to automate firmware/driver inventory and update operations; to perform privileged update tasks it typically runs a service or driver component executing in the SYSTEM context. The CWE-782 classification (Exposed IOCTL with Insufficient Access Control) points to the root cause being a privileged interface - most commonly a kernel-mode device driver IOCTL or a privileged service endpoint - that is reachable by lower-privileged callers without adequately enforcing who may invoke it. The single CPE provided, cpe:2.3:a:nec_corporation:expressupdate_agent_for_windows, identifies the affected component as the application-level agent across unspecified versions, but the privilege-bearing pathway is the SYSTEM-level execution context the agent exposes to local callers.

RemediationAI

Apply the fix referenced in NEC security advisory NV26-004 (https://jpn.nec.com/security-info/secinfo/nv26-004_en.html); a patch is available per the vendor advisory, but the exact corrected version number is not stated in the provided data and should be confirmed directly from that advisory before deployment. Because exploitation requires local access by an already-authenticated low-privileged user, effective compensating controls until patching include restricting interactive and service logon rights on hosts running the agent to trusted administrators only, removing the agent from systems where automated ExpressUpdate management is not actually used (trade-off: loses centralized firmware/driver update automation), and tightening local account hygiene and EDR monitoring for anomalous SYSTEM-spawned processes originating from the agent. Verify the specific fixed build against the NEC advisory rather than assuming a version.