Description
A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege.
Published: 2026-08-25
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A missing authorization flaw in SKYSEA Client View and SKYMEC IT Manager allows a user who can log in to a Windows system to execute arbitrary code with SYSTEM privilege, a classic example of broken access control (CWE-862). The vulnerability can be leveraged for full system compromise, exposing all data and processes on the host.

Affected Systems

The affected products are SKYSEA Client View and SKYMEC IT Manager from Sky Co., LTD. No specific version information is provided, so any installation of these products may be vulnerable unless verified otherwise.

Risk and Exploitability

The CVSS score of 8.5 indicates a high severity level, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires an authenticated session on the local Windows machine, making it a local privilege escalation scenario that can lead to severe confidentiality, integrity, and availability impacts.

Generated by OpenCVE AI on August 25, 2026 at 07:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch or update to the latest version of SKYSEA Client View and SKYMEC IT Manager as soon as it becomes available.
  • Restrict local account credentials that can log into machines running the vulnerable products, enforcing least privilege and disabling unnecessary administrative users.
  • If a patch is unavailable, consider removing or disabling the affected component and isolating the system from untrusted networks until remediation can be applied.

Generated by OpenCVE AI on August 25, 2026 at 07:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Description A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege.
Weaknesses CWE-862
References
Metrics cvssV3_0

{'score': 7.8, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: jpcert

Published:

Updated: 2026-08-25T06:27:50.328Z

Reserved: 2026-08-05T03:02:30.692Z

Link: CVE-2026-66109

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-25T07:17:10.310

Modified: 2026-08-25T07:17:10.310

Link: CVE-2026-66109

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T07:30:12Z

Weaknesses