Description
A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege.
Published: 2026-08-25
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation to SYSTEM
Action: Patch ASAP
AI Analysis

Impact

A missing authorization flaw in SKYSEA Client View and SKYMEC IT Manager allows a user who can log in to a Windows system to execute arbitrary code with SYSTEM privilege, a classic example of broken access control (CWE-862). The vulnerability can be leveraged for full system compromise, exposing all data and processes on the host.

Affected Systems

The affected products are SKYSEA Client View and SKYMEC IT Manager from Sky Co., LTD. No specific version information is provided, so any installation of these products may be vulnerable unless verified otherwise.

Risk and Exploitability

The CVSS score of 8.5 indicates a high severity level, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires an authenticated session on the local Windows machine, making it a local privilege escalation scenario that can lead to severe confidentiality, integrity, and availability impacts.

Generated by OpenCVE AI on August 25, 2026 at 07:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch or update to the latest version of SKYSEA Client View and SKYMEC IT Manager as soon as it becomes available.
  • Restrict local account credentials that can log into machines running the vulnerable products, enforcing least privilege and disabling unnecessary administrative users.
  • If a patch is unavailable, consider removing or disabling the affected component and isolating the system from untrusted networks until remediation can be applied.

Generated by OpenCVE AI on August 25, 2026 at 07:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Skygroup
Skygroup skymec It Manager
Skygroup skysea Client View
Vendors & Products Skygroup
Skygroup skymec It Manager
Skygroup skysea Client View

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Description A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege.
Weaknesses CWE-862
References
Metrics cvssV3_0

{'score': 7.8, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Skygroup Skymec It Manager Skysea Client View
cve-icon MITRE

Status: PUBLISHED

Assigner: jpcert

Published:

Updated: 2026-08-25T19:02:20.730Z

Reserved: 2026-08-05T03:02:30.692Z

Link: CVE-2026-66109

cve-icon Vulnrichment

Updated: 2026-08-25T19:02:17.099Z

cve-icon NVD

Status : Deferred

Published: 2026-08-25T07:17:10.310

Modified: 2026-08-28T16:09:10.947

Link: CVE-2026-66109

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T20:38:09Z

Weaknesses