Number: NV26-006
CVE: CVE-2026-113362, CVE-2026-113363, CVE-2026-113364

Overview

Multiple vulnerabilities exist in WebSAM WinShare.

- An privilege escalation vulnerability due to improper access control settings on the program folder (CVE-2026-113362): An attacker logged in with general user privileges may obtain SYSTEM privileges on the remote operation target (remote PC) of the affected product.

- An arbitrary command execution vulnerability due to improper processing of communication packets in WinShare (CVE-2026-113363): If an attacker sends a specially crafted packet, they can execute arbitrary commands with SYSTEM privileges.

- An arbitrary code execution vulnerability due to a buffer overflow in data reception processing (CVE-2026-113364): If an attacker sends a specially crafted packet, they can execute arbitrary commands with SYSTEM privileges.

Products Affected

WebSAM WinShare

Affected Version

CVE-2026-113362: WebSAM WinShare Ver 7.5.0 and earlier (excluding Ver 7.3.3), WebSAM WinShare Ver 7.6.0 and WebSAM WinShare Ver 7.7.0 through 7.7.1
CVE-2026-113363: WebSAM WinShare Ver 7.2.0 through 7.5.0, WebSAM WinShare Ver 7.6.0 and WebSAM WinShare Ver 7.7.0 through 7.7.2
CVE-2026-113364: WebSAM WinShare Ver 7.5.0 and earlier, WebSAM WinShare Ver 7.6.0 and WebSAM WinShare Ver 7.7.0 through 7.7.2

Solution

Apply the corrective modules below to address these vulnerabilities.
For WinShare Ver 7.6: https://www.support.nec.co.jp/View.aspx?id=9010112140
For WinShare Ver 7.7: https://www.support.nec.co.jp/View.aspx?id=9010112257
Login to the NEC Support Portal is required. (Only Japanese) 
The above modules can also be applied to lower versions, 7.5.0 and earlier.

References

CVE-2026-113362
https://www.cve.org/CVERecord?id=CVE-2026-113362
CVE-2026-113363
https://www.cve.org/CVERecord?id=CVE-2026-113363
CVE-2026-113364
https://www.cve.org/CVERecord?id=CVE-2026-113364

Credit

Update