WinMatrix, an agent developed by Simopro Technology, suffers from a missing authentication weakness that permits a local attacker who has already authenticated to the system to run arbitrary code with SYSTEM privileges. The attacker can execute code on the compromised host and, through the agent’s management capabilities, affect all other hosts within the environment.

All installations of Simopro Technology’s WinMatrix agent are affected. No specific version information is listed in the vendor data.

The vulnerability carries a CVSS score of 9.3 and is not currently listed in the KEV catalog. Exploitation requires local authenticated access to the agent; once achieved, the attacker can execute privileged code on the local machine and remotely control additional hosts. The EPSS score is not available, indicating that exploitation probability has not been quantified, but the high severity score suggests a significant threat if a local attacker gains access.