Vulnerability-Lookup

JVNDB-2026-000097

Vulnerability from jvndb - Published: 2026-08-24 07:21 - Updated:2026-08-25 03:15

Severity

8.5 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

Multiple vulnerabilities in SKYSEA Client View and SKYMEC IT Manager

Details

SKYSEA Client View and SKYMEC IT Manager provided by Sky Co., LTD. contains multiple vulnerabilities listed below.

Missing authorization (CWE-862) - CVE-2026-66109
Path traversal (CWE-22) - CVE-2026-68062

This vulnerability is due to an incomplete fix for CVE-2024-41726, as mentioned in JVN#84326763.

Path traversal (CWE-25) - CVE-2026-68959

This vulnerability is due to an incomplete fix for CVE-2024-41726, as mentioned in JVN#84326763.

Stack-based buffer overflow (CWE-121) - CVE-2026-68960
Incorrect default permissions (CWE-276) - CVE-2026-69665

CVE-2026-66109, CVE-2026-68062, CVE-2026-68959, CVE-2026-68960 Ruslan Sayfiev and Denis Faiustov of Fujitsu Limitedreported these vulnerabilities to Sky Co., LTD. and coordinated. Sky Co., LTD. and JPCERT/CC published respective advisories in order to notify users of the solutions through JVN. CVE-2026-69665 Yuji Hayamizu reported this vulnerability to Sky Co., LTD. and coordinated. Sky Co., LTD. and JPCERT/CC published respective advisories in order to notify users of this vulnerability.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN84326763/
	JVN	https://jvn.jp/en/jp/JVN33423625/
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-66109
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-68062
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-68959
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-68960
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-69665
	Buffer Errors(CWE-119)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Path Traversal(CWE-22)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Permissions(CWE-264)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	Sky Co., LTD.	SKYMEC IT Manager
	Sky Co., LTD.	SKYSEA Client View

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000097.html",
  "dc:date": "2026-08-25T12:15+09:00",
  "dcterms:issued": "2026-08-24T16:21+09:00",
  "dcterms:modified": "2026-08-25T12:15+09:00",
  "description": "SKYSEA Client View and SKYMEC IT Manager provided by Sky Co., LTD. contains multiple vulnerabilities listed below.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/862.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/22.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://www.cve.org/CVERecord?id=CVE-2024-41726\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://jvn.jp/en/jp/JVN84326763/\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/25.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://www.cve.org/CVERecord?id=CVE-2024-41726\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://jvn.jp/en/jp/JVN84326763/\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/121.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/276.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eMissing authorization (CWE-862) - CVE-2026-66109\u003c/li\u003e\u003cli\u003ePath traversal (CWE-22) - CVE-2026-68062\u003c/li\u003e\u003cul\u003e\u003cli\u003eThis vulnerability is due to an incomplete fix for CVE-2024-41726, as mentioned in JVN#84326763.\u003c/li\u003e\u003c/ul\u003e\u003cli\u003ePath traversal (CWE-25) - CVE-2026-68959\u003c/li\u003e\u003cul\u003e\u003cli\u003eThis vulnerability is due to an incomplete fix for CVE-2024-41726, as mentioned in JVN#84326763.\u003c/li\u003e\u003c/ul\u003e\u003cli\u003eStack-based buffer overflow (CWE-121) - CVE-2026-68960\u003c/li\u003e\u003cli\u003eIncorrect default permissions (CWE-276) - CVE-2026-69665\u003c/li\u003e\u003c/ul\u003eCVE-2026-66109, CVE-2026-68062, CVE-2026-68959, CVE-2026-68960\r\nRuslan Sayfiev and Denis Faiustov of Fujitsu Limitedreported these vulnerabilities to Sky Co., LTD. and coordinated. Sky Co., LTD. and JPCERT/CC published respective advisories in order to notify users of the solutions through JVN.\r\n\r\nCVE-2026-69665\r\nYuji Hayamizu reported this vulnerability to Sky Co., LTD. and coordinated. Sky Co., LTD. and JPCERT/CC published respective advisories in order to notify users of this vulnerability.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000097.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:skygroup:skymec_it_manager",
      "@product": "SKYMEC IT Manager",
      "@vendor": "Sky Co., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:skygroup:skysea_client_view",
      "@product": "SKYSEA Client View",
      "@vendor": "Sky Co., LTD.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "8.5",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000097",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN84326763/",
      "@id": "JVN#84326763",
      "@source": "JVN"
    },
    {
      "#text": "https://jvn.jp/en/jp/JVN33423625/",
      "@id": "JVN#33423625",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66109",
      "@id": "CVE-2026-66109",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-68062",
      "@id": "CVE-2026-68062",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-68959",
      "@id": "CVE-2026-68959",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-68960",
      "@id": "CVE-2026-68960",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-69665",
      "@id": "CVE-2026-69665",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-119",
      "@title": "Buffer Errors(CWE-119)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "Multiple vulnerabilities in SKYSEA Client View and SKYMEC IT Manager"
}

CVE-2026-66109 (GCVE-0-2026-66109)

Vulnerability from cvelistv5 – Published: 2026-08-25 06:27 – Updated: 2026-08-25 19:02

Summary

A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 19:02 UTC

CWE

CWE-862 - Missing authorization

Assigner

jpcert jpcert root

References

2 references

URL	Tags
https://www.skyseaclientview.net/news/260824_01/
https://jvn.jp/en/jp/JVN33423625/

Impacted products

2 products

Vendor	Product	Version
Sky Co., LTD.	SKYSEA Client View	Affected: 0 , ≤ Ver.21.210.01f (semver)
Sky Co., LTD.	SKYMEC IT Manager	Affected: 2023.225.03a Affected: 2024.005.10a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66109",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T19:02:13.183956Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T19:02:20.730Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SKYSEA Client View",
          "vendor": "Sky Co., LTD.",
          "versions": [
            {
              "lessThanOrEqual": "Ver.21.210.01f",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SKYMEC IT Manager",
          "vendor": "Sky Co., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "2023.225.03a"
            },
            {
              "status": "affected",
              "version": "2024.005.10a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing authorization",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T06:27:50.328Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.skyseaclientview.net/news/260824_01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN33423625/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-66109",
    "datePublished": "2026-08-25T06:27:50.328Z",
    "dateReserved": "2026-08-05T03:02:30.692Z",
    "dateUpdated": "2026-08-25T19:02:20.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68062 (GCVE-0-2026-68062)

Vulnerability from cvelistv5 – Published: 2026-08-25 06:27 – Updated: 2026-08-25 15:07

Summary

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected products installed and can receive UDP packets from that system. Note that this vulnerability is due to an incomplete fix for CVE-2024-41726.

Severity

8.5 (High)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

5.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 15:02 UTC

CWE

CWE-22 - Improper limitation of a pathname to a restricted directory ('Path Traversal')

Assigner

jpcert jpcert root

References

2 references

URL	Tags
https://www.skyseaclientview.net/news/260824_01/
https://jvn.jp/en/jp/JVN33423625/

Impacted products

2 products

Vendor	Product	Version
Sky Co., LTD.	SKYSEA Client View	Affected: Ver.19.300.09h , ≤ Ver.21.210.01f (semver)
Sky Co., LTD.	SKYMEC IT Manager	Affected: Ver.2024.005.10a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68062",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T15:02:47.382405Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T15:07:18.811Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SKYSEA Client View",
          "vendor": "Sky Co., LTD.",
          "versions": [
            {
              "lessThanOrEqual": "Ver.21.210.01f",
              "status": "affected",
              "version": "Ver.19.300.09h",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SKYMEC IT Manager",
          "vendor": "Sky Co., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.2024.005.10a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected products installed and can receive UDP packets from that system. Note that this vulnerability is due to an incomplete fix for CVE-2024-41726."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper limitation of a pathname to a restricted directory (\u0027Path Traversal\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T06:27:54.700Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.skyseaclientview.net/news/260824_01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN33423625/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-68062",
    "datePublished": "2026-08-25T06:27:54.700Z",
    "dateReserved": "2026-08-05T03:02:22.123Z",
    "dateUpdated": "2026-08-25T15:07:18.811Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68959 (GCVE-0-2026-68959)

Vulnerability from cvelistv5 – Published: 2026-08-25 06:27 – Updated: 2026-08-25 19:52

Summary

Severity

8.5 (High)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

5.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 19:51 UTC

CWE

CWE-25 - Path Traversal: '/../filedir'

Assigner

jpcert jpcert root

References

2 references

URL	Tags
https://www.skyseaclientview.net/news/260824_01/
https://jvn.jp/en/jp/JVN33423625/

Impacted products

2 products

Vendor	Product	Version
Sky Co., LTD.	SKYSEA Client View	Affected: Ver.19.300.09h , ≤ Ver.21.210.01f (semver)
Sky Co., LTD.	SKYMEC IT Manager	Affected: Ver.2024.005.10a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68959",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T19:51:44.725770Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T19:52:07.568Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SKYSEA Client View",
          "vendor": "Sky Co., LTD.",
          "versions": [
            {
              "lessThanOrEqual": "Ver.21.210.01f",
              "status": "affected",
              "version": "Ver.19.300.09h",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SKYMEC IT Manager",
          "vendor": "Sky Co., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.2024.005.10a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected products installed and can receive UDP packets from that system. Note that this vulnerability is due to an incomplete fix for CVE-2024-41726."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-25",
              "description": "Path Traversal: \u0027/../filedir\u0027",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T06:27:59.698Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.skyseaclientview.net/news/260824_01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN33423625/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-68959",
    "datePublished": "2026-08-25T06:27:59.698Z",
    "dateReserved": "2026-08-05T03:02:22.910Z",
    "dateUpdated": "2026-08-25T19:52:07.568Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68960 (GCVE-0-2026-68960)

Vulnerability from cvelistv5 – Published: 2026-08-25 06:27 – Updated: 2026-08-25 15:07

Summary

A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected product installed and can receive UDP packets from that system.

Severity

8.5 (High)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

5.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 15:07 UTC

CWE

CWE-121 - Stack-based buffer overflow

Assigner

jpcert jpcert root

References

2 references

URL	Tags
https://www.skyseaclientview.net/news/260824_01/
https://jvn.jp/en/jp/JVN33423625/

Impacted products

2 products

Vendor	Product	Version
Sky Co., LTD.	SKYSEA Client View	Affected: 0 , ≤ Ver.21.210.01f (semver)
Sky Co., LTD.	SKYMEC IT Manager	Affected: 2023.225.03a Affected: 2024.005.10a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68960",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T15:07:33.377057Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T15:07:50.519Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SKYSEA Client View",
          "vendor": "Sky Co., LTD.",
          "versions": [
            {
              "lessThanOrEqual": "Ver.21.210.01f",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SKYMEC IT Manager",
          "vendor": "Sky Co., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "2023.225.03a"
            },
            {
              "status": "affected",
              "version": "2024.005.10a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected product installed and can receive UDP packets from that system."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based buffer overflow",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T06:27:20.798Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.skyseaclientview.net/news/260824_01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN33423625/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-68960",
    "datePublished": "2026-08-25T06:27:20.798Z",
    "dateReserved": "2026-08-05T03:02:31.621Z",
    "dateUpdated": "2026-08-25T15:07:50.519Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-69665 (GCVE-0-2026-69665)

Vulnerability from cvelistv5 – Published: 2026-08-25 06:27 – Updated: 2026-08-25 15:08

Summary

SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 15:08 UTC

CWE

CWE-276 - Incorrect default permissions

Assigner

jpcert jpcert root

References

2 references

URL	Tags
https://www.skyseaclientview.net/news/260824_01/
https://jvn.jp/en/jp/JVN33423625/

Impacted products

2 products

Vendor	Product	Version
Sky Co., LTD.	SKYSEA Client View	Affected: 0 , ≤ Ver.21.300.12g (semver)
Sky Co., LTD.	SKYMEC IT Manager	Affected: 0 , ≤ Ver.2025.205.08a (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-69665",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T15:08:08.563229Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T15:08:24.081Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SKYSEA Client View",
          "vendor": "Sky Co., LTD.",
          "versions": [
            {
              "lessThanOrEqual": "Ver.21.300.12g",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SKYMEC IT Manager",
          "vendor": "Sky Co., LTD.",
          "versions": [
            {
              "lessThanOrEqual": "Ver.2025.205.08a",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "Incorrect default permissions",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T06:27:10.352Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.skyseaclientview.net/news/260824_01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN33423625/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-69665",
    "datePublished": "2026-08-25T06:27:10.352Z",
    "dateReserved": "2026-08-05T03:02:29.908Z",
    "dateUpdated": "2026-08-25T15:08:24.081Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

JVNDB-2026-000097

CVE-2026-66109 (GCVE-0-2026-66109)

CVE-2026-68062 (GCVE-0-2026-68062)

CVE-2026-68959 (GCVE-0-2026-68959)

CVE-2026-68960 (GCVE-0-2026-68960)

CVE-2026-69665 (GCVE-0-2026-69665)

Tags

Sightings

Nomenclature

Related by attack behaviour