NEC patches WebSAM WinShare flaws that give SYSTEM on remote PCs

NEC patches WebSAM WinShare flaws that give SYSTEM on remote PCs

9 November 2026: NEC has published fixes for three flaws in WebSAM WinShare, its remote PC operation product. CVE-2026-113363 and CVE-2026-113364 let an unauthenticated attacker run commands as SYSTEM with a crafted packet and score 9.8 on CVSS v3, according to JVN. Neither NEC nor JVN reports exploitation. The fix is a set of corrective modules.

Three flaws, two of them reachable over the network

• CVE-2026-113363 comes from improper processing of communication packets. A specially crafted packet runs arbitrary commands with SYSTEM privileges. JVN classes the weakness as an exposed dangerous method and gives it CVSS v3 9.8, CVSS v4 9.3.
• CVE-2026-113364 is a buffer overflow in data reception, with the same outcome from a crafted packet. CVSS v3 9.8, CVSS v4 9.3.
• CVE-2026-113362 is local. Weak access control on the program folder lets someone logged in as an ordinary user gain SYSTEM on the remote operation target. CVSS v3 7.8, CVSS v4 8.5.

Fujitsu's Ruslan Sayfiev and Denis Faiustov and Masahiro Kawada reported the issues.

Which versions need the modules

Coverage differs slightly by flaw:

CVE	Affected WinShare versions
CVE-2026-113362	7.5.0 and earlier (excluding 7.3.3), 7.6.0, 7.7.0 to 7.7.1
CVE-2026-113363	7.2.0 to 7.5.0, 7.6.0, 7.7.0 to 7.7.2
CVE-2026-113364	7.5.0 and earlier, 7.6.0, 7.7.0 to 7.7.2

NEC does not name a fixed version number. It publishes one corrective module for the 7.6 line and one for 7.7, and says the modules can also be applied to 7.5.0 and earlier. Both are on the NEC Support Portal, identifiers 9010112140 and 9010112257. A login is required and the pages are in Japanese only, so customers without a support contract, or teams outside Japan, may need to go through their reseller.

Where exposure is highest

WinShare is built to be reached from another machine, so the two network flaws land on exactly the listening service the product depends on. NEC's advisory offers no workaround beyond the modules. Until they are applied, the sensible restriction is network reach: the remote operation port should answer only from the administrators' own subnet or jump host, never from general user networks or the internet. Check for SYSTEM-level processes started by the WinShare service on endpoints that have been exposed.

Other remote access tools we list

Our remote desktop software category lists 20 products, among them AnyDesk. WinShare is not listed.

Related on TrustList:

• TeamViewer fixes five vulnerabilities, including a remote session access-control bypass: update Full Client and Host to 15.82

Sources

• NEC: NV26-006, Multiple Vulnerabilities in WebSAM WinShare, 9 November 2026
• JVN: JVN89009783, WebSAM WinShare vulnerabilities, 9 November 2026