JVN and NEC score it CVSS 4.0 9.3 Critical and CVSS 3.0 9.8 Critical. The same advisory, JVN#89009783, also covers a heap-based buffer overflow (CVE-2026-113364) and a local DLL-planting flaw (CVE-2026-113362) in the same product.
What it allows
CVE-2026-113363 is one of three vulnerabilities JVN#89009783 reports in NEC Corporation's WebSAM WinShare, a Windows tool for managing remote PCs. The advisory says a specially crafted network packet sent to a device running WinShare's "Remote PC" component may let an attacker run an arbitrary command with SYSTEM privileges. No authentication is needed.
The NVD record names the root cause as improper input validation in WinShare's network communication processing. JVN classifies the flaw as an exposed dangerous method or function, CWE-749.
What the Other Two Flaws in the Same Advisory Do
The same advisory lists CVE-2026-113364, a heap-based buffer overflow (CWE-122) in WinShare's data-receiving process. NVD says a crafted packet with a malformed data-size value in the protocol header may let a remote, unauthenticated attacker run arbitrary code with SYSTEM privileges.
CVE-2026-113362 needs local access instead. JVN lists it as incorrect default permissions in the program installation folder (CWE-276). NVD says a locally authenticated, low-privileged attacker can plant a crafted DLL file that a SYSTEM-level process then loads, gaining SYSTEM privileges. This matches the pattern our own DLL hijacking entry describes.
How CVSS Scores CVE-2026-113363
NEC and JVN score CVE-2026-113363 as CVSS 4.0 9.3 Critical and CVSS 3.0 9.8 Critical. Its CVSS 4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Its CVSS 3.0 vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
NVD lists the 4.0 score as a secondary source. No CVSS 3.1 score appears in either record. See our CVSS entry for how to read the vector.
CVE-2026-113364 carries the same 9.3 Critical (CVSS 4.0) and 9.8 Critical (CVSS 3.0) scores. Both are network vectors needing no privileges or user interaction. CVE-2026-113362 scores lower, CVSS 4.0 8.5 High and CVSS 3.0 7.8 High, because it needs local, low-privileged access.
What NEC and CISA KEV Say
The JVN advisory's only remedy is to update WebSAM WinShare to the latest version NEC provides. Neither JVN nor NVD names a specific fixed version number. As of CISA catalog version 2026.11.06, none of the three CVEs appear in the Known Exploited Vulnerabilities catalog. See our KEV glossary entry for how the catalog works.
Who is affected
The table below lists the versions JVN#89009783 names as affected, by CVE. Neither JVN nor NVD gives a specific fixed version number; the advisory's remedy is to update to NEC's currently provided version.
| CVE | CWE | Affected Versions |
|---|---|---|
| CVE-2026-113363 | CWE-749 | Ver 7.2.0 to 7.5.0, Ver 7.6.0, Ver 7.7.0 to 7.7.2 |
| CVE-2026-113364 | CWE-122 | Ver 7.5.0 and earlier, Ver 7.6.0, Ver 7.7.0 to 7.7.2 |
| CVE-2026-113362 | CWE-276 | Ver 7.5.0 and earlier (excluding Ver 7.3.3), Ver 7.6.0, Ver 7.7.0 to 7.7.1 |
Ruslan Sayfiev and Denis Faiustov of Fujitsu Limited, and Masahiro Kawada, reported the three flaws to Japan's IPA. JPCERT/CC coordinated the disclosure with NEC under the Information Security Early Warning Partnership.
Timeline
- 9 Nov 2026
JVN publishes JVN#89009783 covering all three CVEs; NVD publishes the CVE-2026-113362, CVE-2026-113363 and CVE-2026-113364 records the same day.
What to do
-
Inventory WebSAM WinShare Installs
List every WebSAM WinShare install and its exact version. Note which expose the Remote PC component to the network.
-
Update to NEC's Latest Build
Update WebSAM WinShare to the version NEC currently provides, as the advisory directs. Our patch management entry covers how to plan the rollout.
-
Restrict Network Access to Remote PC
We recommend placing the Remote PC component behind a firewall or VPN until every install is updated. CVE-2026-113363 and CVE-2026-113364 need no authentication, so network exposure is the main risk.
-
Review Install-Folder Permissions
Check who can write to the WebSAM WinShare installation folder. CVE-2026-113362 needs a low-privileged local account that can place a file there.
-
Watch CISA KEV for These Three CVE IDs
None of the three CVEs are in the Known Exploited Vulnerabilities catalog yet. We recommend checking the catalog again, given how little CVE-2026-113363 and CVE-2026-113364 need from an attacker.
Frequently Asked Questions
Which WebSAM WinShare Versions Does CVE-2026-113363 Affect?
JVN#89009783 lists Ver 7.2.0 to 7.5.0, Ver 7.6.0, and Ver 7.7.0 to 7.7.2 as affected.
Do CVE-2026-113363 and CVE-2026-113364 Need Authentication?
No. NVD describes both as remote, unauthenticated flaws triggered by a crafted network packet.
What Does CVE-2026-113362 Need?
NVD says it needs a locally authenticated, low-privileged account that can place a crafted DLL file for a SYSTEM-level process to load.
Is There a Specific Fixed Version Number?
No. The advisory's only remedy is to update to the latest version NEC provides; neither JVN nor NVD names one.
Are These Three CVEs in the CISA KEV Catalog?
Not as of catalog version 2026.11.06. Neither the advisory nor NVD states whether any of the three has been exploited.
