critical · CVSS v3 9.8 · CVSS v4 9.3

CVE-2026-113363

NEC WebSAM WinShare versions 7.2.0-7.5.0, 7.6.0, and 7.7.0-7.7.2 on Windows contain an input validation flaw that allows a remote unauthenti

Overview

NEC WebSAM WinShare versions 7.2.0-7.5.0, 7.6.0, and 7.7.0-7.7.2 on Windows contain an input validation flaw that allows a remote unauthenticated attacker to send a crafted packet and execute arbitrary commands with SYSTEM privileges. The vulnerability can compromise the entire host and expose sensitive data. It affects organizations using these WinShare versions.

Description

Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges via a crafted network packet sent to the computer on which WinShare is running.

Impact

Confidentiality: attacker can read or modify any data on the host. Integrity: attacker can alter system files or configurations. Availability: attacker can disrupt services by executing arbitrary commands. The primary impact is on systems running the vulnerable WinShare versions, potentially exposing sensitive data and allowing full system compromise.

Remediation

Apply the vendor-supplied patch for WinShare 7.2.0-7.5.0, 7.6.0, and 7.7.0-7.7.2. If a patch is not yet available, block inbound traffic to the WinShare service using firewall rules or isolate the host. Verify the patch by checking the installed version and testing the service after update.

Risk context

The vulnerability has a critical severity rating of 9.8 and CVSS v4 score of 9.3, indicating a high risk of exploitation. No EPSS data is available, but the lack of authentication requirement and SYSTEM privilege escalation make it a top priority for immediate remediation.

Affected products

  • NEC WebSAM WinShare 7.2-7.5
  • NEC WebSAM WinShare 7.6
  • NEC WebSAM WinShare 7.7

Scores

Severity
critical
CVSS v2
10
CVSS v3
9.8
CVSS v4
9.3
EPSS
—

input-validation remote-code-execution system-privilege NEC WinShare critical authentication-bypass

← All CVEs

Related CVEs

critical

CVE-2026-119506

Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.

View analysis

critical

CVE-2026-124560

A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

View analysis

critical

CVE-2026-113364

NEC WebSAM WinShare on Windows has a critical buffer overflow that allows a remote unauthenticated attacker to execute code with SYSTEM privileges. The flaw exists in versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2. It can be triggered by sending a crafted packet with a malformed data size value in the protocol header.

View analysis

critical

CVE-2026-115213

The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.

View analysis