{"id":"CVE-2026-113362","kind":"vulnerability","aliases":["CVE-2026-113362"],"related":[],"title":"NEC WebSAM Winshare: local users can run code as SYSTEM on Windows","description":"Improper Access Control in the program installation folder in NEC Corporation WebSAM Winshare Ver 7.5.0 and earlier (excluding Ver 7.3.3), Ver 7.6.0 and Ver 7.7.0 through 7.7.1 on Windows allows a locally authenticated low-privileged attacker to execute arbitrary code with SYSTEM privileges via a crafted DLL file that is loaded by a SYSTEM-level process.","summary":"NEC WebSAM Winshare versions 7.5.0 and earlier (excluding 7.3.3), 7.6.0, and 7.7.0 through 7.7.1 on Windows have an access control flaw in the program installation folder. A locally logged-in low-privileged user can plant a crafted DLL that a SYSTEM-level process loads, so the attacker runs arbitrary code with SYSTEM privileges.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nec","vendor","websam-winshare","windows"],"not_affected_if":["admin-only-install-folder","not-installed"],"how_to_check":"- Check the installed WebSAM Winshare version in the program's About dialog or installed-programs list against the affected ranges.\n- Review the write permissions on the WebSAM Winshare installation folder for non-administrative users.","fix":"- Move to a version after the affected ranges (7.7.1 is the last affected release in the 7.7 line; the fixed version is unknown from the sources).","status":"open","published_at":"2026-11-09T04:17:06+00:00","first_seen_at":"2026-11-09T04:24:36+00:00","triaged_at":"2026-11-09T04:26:36+00:00","updated_at":"2026-11-09T04:26:36+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-09T04:26:36Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version after the affected ranges (7.7.1 is the last affected release in the 7.7 line; the fixed version is unknown from the sources).","reach":"local","title":"NEC WebSAM Winshare: local users can run code as SYSTEM on Windows","impact":"high","summary":"NEC WebSAM Winshare versions 7.5.0 and earlier (excluding 7.3.3), 7.6.0, and 7.7.0 through 7.7.1 on Windows have an access control flaw in the program installation folder. A locally logged-in low-privileged user can plant a crafted DLL that a SYSTEM-level process loads, so the attacker runs arbitrary code with SYSTEM privileges.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["windows","nec","websam-winshare"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gets SYSTEM-level code execution on Windows","analyst_note":"Find NEC's advisory for the fixed version and the exact affected build list; the NVD entry alone does not give a fixed release.","how_to_check":"- Check the installed WebSAM Winshare version in the program's About dialog or installed-programs list against the affected ranges.\n- Review the write permissions on the WebSAM Winshare installation folder for non-administrative users.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-installed","admin-only-install-folder"],"who_is_affected":"Windows machines running WebSAM Winshare 7.5.0 or earlier (except 7.3.3), 7.6.0, or 7.7.0 through 7.7.1. The risk requires a local, already-authenticated low-privileged user who can write to the installation folder. Machines without this product, or where the install folder is restricted to administrators, are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0008,"input_tokens":4615,"output_tokens":676,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113362':15A,18A '-2026':14A,17A '7.3.3':33B,100C '7.5.0':29B,95C '7.6.0':34B,102C '7.7.0':36B,105C '7.7.1':38B,107C 'access':43B,82C 'allow':110C 'arbitrari':76B,120C 'attack':74B,117C 'authent':113C 'code':8A,77B,121C 'control':44B,83C 'corpor':91C 'craft':63B,127C 'cve':13A,16A 'dll':64B,128C 'earlier':31B,97C 'exclud':32B,98C 'execut':119C 'file':129C 'flaw':45B 'folder':50B,88C 'improp':81C 'instal':49B,87C 'level':69B,137C 'load':71B,132C 'local':4A,52B,112C 'log':54B 'logged-in':53B 'low':57B,115C 'low-privileg':56B,114C 'nec':1A,19B,25B,90C 'plant':61B 'privileg':58B,80B,116C,124C 'process':70B,138C 'program':48B,86C 'run':7A,75B 'system':10A,68B,79B,123C,136C 'system-level':67B,135C 'user':5A,59B 'vendor':20B 'ver':94C,99C,101C,104C 'version':28B 'via':125C 'websam':2A,22B,26B,92C 'websam-winshar':21B 'window':12A,24B,40B,109C 'winshar':3A,23B,27B,93C","nicknames":[],"mitigations":[],"who_affected":"Windows machines running WebSAM Winshare 7.5.0 or earlier (except 7.3.3), 7.6.0, or 7.7.0 through 7.7.1. The risk requires a local, already-authenticated low-privileged user who can write to the installation folder. Machines without this product, or where the install folder is restricted to administrators, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","nec","vendor","websamwinshare","windows"],"campaign_type":null,"search_a":"'-113362':15A,18A '-2026':14A,17A 'code':8A 'cve':13A,16A 'local':4A 'nec':1A 'run':7A 'system':10A 'user':5A 'websam':2A 'window':12A 'winshar':3A","search_b":"'7.3.3':33B '7.5.0':29B '7.6.0':34B '7.7.0':36B '7.7.1':38B 'access':43B 'arbitrari':76B 'attack':74B 'code':77B 'control':44B 'craft':63B 'dll':64B 'earlier':31B 'exclud':32B 'flaw':45B 'folder':50B 'instal':49B 'level':69B 'load':71B 'local':52B 'log':54B 'logged-in':53B 'low':57B 'low-privileg':56B 'nec':19B,25B 'plant':61B 'privileg':58B,80B 'process':70B 'program':48B 'run':75B 'system':68B,79B 'system-level':67B 'user':59B 'vendor':20B 'version':28B 'websam':22B,26B 'websam-winshar':21B 'window':24B,40B 'winshar':23B,27B","search_c":"'7.3.3':100C '7.5.0':95C '7.6.0':102C '7.7.0':105C '7.7.1':107C 'access':82C 'allow':110C 'arbitrari':120C 'attack':117C 'authent':113C 'code':121C 'control':83C 'corpor':91C 'craft':127C 'dll':128C 'earlier':97C 'exclud':98C 'execut':119C 'file':129C 'folder':88C 'improp':81C 'instal':87C 'level':137C 'load':132C 'local':112C 'low':115C 'low-privileg':114C 'nec':90C 'privileg':116C,124C 'process':138C 'program':86C 'system':123C,136C 'system-level':135C 'ver':94C,99C,101C,104C 'via':125C 'websam':92C 'window':109C 'winshar':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T04:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt-info@cyber.jp.nec.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113362","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113362","severity":null,"published_at":"2026-11-09T04:17:06+00:00","modified_at":"2026-11-09T04:17:06+00:00","first_seen_at":"2026-11-09T04:24:36+00:00","fetched_at":"2026-11-09T04:24:36+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}