External risk intelligence

NEC WebSAM WinShare SYSTEM Privilege Command Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-113363

The product is designed to process network communication for systems management. As an unauthenticated remote service listening for network packets, it is typically deployed to be reachable across the network, making it a likely candidate for exposure in environments where management infrastructure is accessible or not strictly segmented.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in NEC's WebSAM WinShare software allows remote attackers to execute commands with full system privileges by sending a specially crafted network packet. This issue stems from improper input validation during network communication processing within the affected product.

Network vulnerability could allow full system control.
Critical for systems management and data security.
Confirm relevance and exposure within our environment.

Attack Path

How an attacker could exploit the issue

An attacker can initiate an attack by sending a specially crafted network packet to a vulnerable system. This packet targets the network communication processing component of the software, which improperly validates incoming data. If successful, this could allow an unauthenticated remote attacker to execute arbitrary commands with the highest system privileges.

Entry Condition: Attacker can reach the network service.
Trigger Point: Sending a malicious network packet.
Resulting Risk: Arbitrary code execution with SYSTEM privileges.

Live Threat

Current exploitation, exposure, and threat context

A remote, unauthenticated attacker could execute arbitrary commands with SYSTEM privileges on a Windows computer running NEC Corporation WebSAM WinShare when it processes a specially crafted network packet. This vulnerability affects system data and service behavior.

System commands could be executed.
Via crafted network packets.
Compromise of the affected system.

Operational Fix

Recommended remediation, mitigation, and detection steps

The NEC WebSAM WinShare product's improper input validation can allow remote attackers to execute commands with SYSTEM privileges. Identifying where this software is deployed, confirming its network reachability and business criticality, and then determining the accountable owner are the initial steps. Planning remediation based on the assessed risk should follow.

Application owners should manage the issue.
Verify network reachability and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NEC WebSAM WinShare?

NEC WebSAM WinShare is a systems management software suite for Windows environments. It is designed to facilitate resource sharing and administrative tasks across networks. Organizations use it to streamline the management of IT infrastructure, often requiring the software to maintain active network communication channels to function correctly across multiple systems.

How does CVE-2026-113363 impact system security?

This CVE involves a vulnerability classified as Improper Input Validation (CWE-749). In plain terms, the software fails to correctly check the data it receives over the network. Because the component handling this data runs with high-level SYSTEM privileges, an attacker who successfully exploits this flaw can command the underlying Windows operating system to perform unauthorized actions with the same elevated permissions.

Do I need to be authenticated to trigger this vulnerability?

No, authentication is not required. The flaw exists in the software's network communication processing, meaning an attacker does not need a valid user account or password to interact with the service. Simply sending a specially crafted network packet to the vulnerable port is sufficient. It is not triggered by standard, legitimate network traffic or normal software operations.

Is my system at risk if it runs WebSAM WinShare?

Halo Surface Signal indicates that because this product is built to handle network communications for systems management, it is often placed where it is reachable across a network. If your instance is accessible to untrusted network segments, it is more likely to be exposed. You should evaluate whether the affected server is isolated or reachable by unauthorized parties.

How should I respond to this threat advisory?

Start by identifying all Windows machines in your environment where WebSAM WinShare is installed. Once located, verify the software's specific network reachability and its importance to your business operations. Determine who owns these systems and coordinate with them to evaluate the risk, confirm whether the software is currently required, and prepare for potential remediation steps.

References

jpn.nec.com/security-info/secinfo/nv26-006_en.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.