NEC has disclosed three critical vulnerabilities in its WebSAM WinShare software, including CVE-2026-113364, a heap-based buffer overflow that lets a remote unauthenticated attacker run code with SYSTEM privileges. The advisory, numbered NV26-006 and published on 9 November 2026, covers WinShare versions up to 7.7.2 on Windows.

CVE-2026-113364 carries a CVSS 4.0 score of 9.3, rated critical. It sits in the data reception processing of WinShare: an attacker who sends a specially crafted packet containing a malformed data size value in the protocol header can trigger the overflow and execute arbitrary code with SYSTEM privileges, the highest level of access on a Windows machine.

Three flaws in one advisory

The advisory covers three separate vulnerabilities. CVE-2026-113363 is an arbitrary command execution flaw caused by improper processing of communication packets in WinShare. A remote unauthenticated attacker who sends a specially crafted network packet to a computer running WinShare can execute arbitrary commands with SYSTEM privileges.

CVE-2026-113362 is a privilege escalation flaw caused by improper access control settings on the program folder. An attacker logged in with general user privileges may obtain SYSTEM privileges on the remote operation target, the remote PC that WinShare is used to operate. WinShare is NEC's software for remotely operating PCs, which makes the flaws especially serious for organisations that use it to manage machines across a network.

The flaws were reported by Ruslan Sayfiev and Denis Faiustov of Fujitsu Limited, and by Masahiro Kawada, according to NEC's advisory.

Which versions are affected

CVE-2026-113364 affects WebSAM WinShare version 7.5.0 and earlier, version 7.6.0, and versions 7.7.0 through 7.7.2. CVE-2026-113363 affects versions 7.2.0 through 7.5.0, version 7.6.0, and versions 7.7.0 through 7.7.2. CVE-2026-113362 affects version 7.5.0 and earlier, excluding version 7.3.3, along with version 7.6.0 and versions 7.7.0 through 7.7.1.

All three flaws affect WinShare running on Windows. NEC's advisory, published as a first edition on 9 November, does not name a patched release in the text published that day. Until NEC issues a fix, administrators should restrict network access to the WinShare service so it is not reachable from untrusted networks, and monitor for suspicious packets matching the malformed data size pattern described in the CVE record.

No exploitation reported yet

There is no evidence so far that any of the three flaws has been exploited in the wild. None of them appears in CISA's Known Exploited Vulnerabilities catalog, and no public exploit code has been indexed in the Metasploit or Exploit-DB collections. That does not mean the flaws are safe to ignore: a remotely reachable, unauthenticated flaw with SYSTEM-level impact is exactly the kind of vulnerability attackers scan for once details become public.

The disclosure comes in a busy period for critical Windows software flaws. It follows the disclosure of several high-severity vulnerabilities in widely used products in recent weeks, and it underlines how remote management tools, which are designed to give administrators full control of machines, become powerful targets when they contain their own flaws.

What administrators should do

Organisations running WinShare should first check which version they have installed against the affected ranges in NEC's advisory. Any system on an affected version should be treated as exposed if its WinShare service can be reached over a network, and network access to it should be limited to trusted hosts only.

Administrators should also watch for NEC's patched release and apply it as soon as it is available, and review logs for unusual packets or unexpected SYSTEM-level activity on machines running WinShare. The advisory is the authoritative source for the affected versions and any update NEC publishes.