How do I check whether I am affected by CVE-2026-26846?

Check the installed EBPro version (Help > About in EasyBuilder Pro, or the install folder). Build 6.10.01.510_20251022 is the only confirmed affected build; other builds are unverified. Check whether UtilityManagerEx.exe is running or listening (netstat -ano, tasklist) and keep it off untrusted networks.

What is the fix for CVE-2026-26846?

No vendor-confirmed fix. Weinview lists newer builds (EBPro V6.10.02.421_20260827, V6.10.01.667_20260827); their release notes do not mention this CVE, so confirm with Weinview before relying on them. Meanwhile, firewall engineering workstations from untrusted networks.

Who is not affected by CVE-2026-26846?

Not affected if: no-network-exposure, other-versions-unverified.

Live › vulnerability › CVE-2026-26846

Go to dashboard

critical9.8Infrastructure

Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute…

Buffer overflow (CWE-120) in UtilityManagerEx.exe of Weinview (Weintek) EasyBuilder Pro build 6.10.01.510_20251022, CVSS 9.8 per CNA. Reported Dec 2025, disclosed 2026-10-16 by PRISMI-Team. No vendor advisory, no public PoC, no known exploitation. UtilityManagerEx.exe is likely an engineering-workstation utility, so exposure is probably limited to OT/engineering networks (inference, not confirmed).

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0

known so far5 of 6

missing: exploitation

First public: Oct 16, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Remote attacker runs arbitrary code on the affected Windows host.
CVSS said: 9.8. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-26846

Go to dashboard

critical9.8Infrastructure

Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute…

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0

known so far5 of 6

missing: exploitation

First public: Oct 16, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Remote attacker runs arbitrary code on the affected Windows host.
CVSS said: 9.8. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute…

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute…

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources