CVE-2026-68062

MediumCVSS 5.8/10Last modified Aug 28, 2026

Description

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected products installed and can receive UDP packets from that system. Note that this vulnerability is due to an incomplete fix for CVE-2024-41726.

Metrics

CVSS 4.0 5.8/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Sky Co., LTD.	SKYSEA Client View	>= Ver.19.300.09h, <= Ver.21.210.01f
Sky Co., LTD.	SKYMEC IT Manager	Ver.2024.005.10a

References

Timeline

Published: Aug 25, 2026
Last modified: Aug 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-680679.8The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for t CVE-2026-680689.0The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-CVE-2026-68075.5A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended CVE-2026-680708.8The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received byt CVE-2026-680737.5A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issu CVE-2026-680747.5A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This CVE-2026-680756.5An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affect CVE-2026-680765.4Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard m CVE-2026-680776.5An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling CVE-2026-680786.5It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause exces CVE-2026-680799.8In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw CVE-2026-68086.1The Pricing Tables for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up t