Information from NEC Corporation
Vulnerability ID:JVN#89009783
Title:Multiple vulnerabilities in WebSAM WinShare
Status:Vulnerable
This is a statement from the vendor itself with no modification by JPCERT/CC.
Multiple Vulnerabilities in WebSAM WinShare
Number: NV26-006
CVE: CVE-2026-113362, CVE-2026-113363, CVE-2026-113364
Overview
Multiple vulnerabilities exist in WebSAM WinShare.
- An privilege escalation vulnerability due to improper access control settings on the program folder (CVE-2026-113362): An attacker logged in with general user privileges may obtain SYSTEM privileges on the remote operation target (remote PC) of the affected product.
- An arbitrary command execution vulnerability due to improper processing of communication packets in WinShare (CVE-2026-113363): If an attacker sends a specially crafted packet, they can execute arbitrary commands with SYSTEM privileges.
- An arbitrary code execution vulnerability due to a buffer overflow in data reception processing (CVE-2026-113364): If an attacker sends a specially crafted packet, they can execute arbitrary commands with SYSTEM privileges.
Products Affected
WebSAM WinShare
Affected Versions
CVE-2026-113362: WebSAM WinShare Ver 7.5.0 and earlier (excluding Ver 7.3.3), WebSAM WinShare Ver 7.6.0 and WebSAM WinShare Ver 7.7.0 through 7.7.1
CVE-2026-113363: WebSAM WinShare Ver 7.2.0 through 7.5.0, WebSAM WinShare Ver 7.6.0 and WebSAM WinShare Ver 7.7.0 through 7.7.2
CVE-2026-113364: WebSAM WinShare Ver 7.5.0 and earlier, WebSAM WinShare Ver 7.6.0 and WebSAM WinShare Ver 7.7.0 through 7.7.2
Solution
Apply the corrective modules below to address these vulnerabilities. (Only Japanese)
For WinShare Ver 7.6: https://www.support.nec.co.jp/View.aspx?id=9010112140
For WinShare Ver 7.7: https://www.support.nec.co.jp/View.aspx?id=9010112257
Login to the NEC Support Portal is required.
The above modules can also be applied to lower versions, 7.5.0 and earlier.
References
CVE-2026-113362
https://www.cve.org/CVERecord?id=CVE-2026-113362
CVE-2026-113363
https://www.cve.org/CVERecord?id=CVE-2026-113363
CVE-2026-113364
https://www.cve.org/CVERecord?id=CVE-2026-113364
Credit
reported by Ruslan Sayfiev and Denis Faiustov of Fujitsu Limited, and Masahiro Kawada.
Update
2026/11/9: First edition