by Kastro
Paper/Archive/CVE-2026-6348

CVE-2026-6348

Simopro Technology WinMatrix — Simopro Technology｜WinMatrix - Missing Authentication

EPSS 0.2%CVSS 9.3
critical.is priorityof 100
29
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 7.6.076 × 201.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability, allowing authenticated local attackers to execute arbitrary code with SYSTEM privileges on the local machine as well as on all hosts within the environment where the agent is installed.

Affected

ProductAffectedFixed inSource
WinMatrix3.5.13 – 3.5.26.15–CNA

Scores by source

twcert (CNA)9.3CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
twcert (CNA)8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-10839-2d9a7-1.htmlwriteuptwcert.org.tw/en/cp-139-10840-ba9b9-2.html