VulnSocial

CVE-2026-6348Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability, allowing authenticated local attackers to execute arbitrary code with SYSTEM privileges on the local machine as well as on all hosts within the environment where the agent is installed.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • Peaked 1d ago at 3 mentions (2026-04-16); latest day: 1
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-04-16: 3Mentions · 2026-04-17: 1Technical Details · 2026-04-16: 3Technical Details · 2026-04-17: 104-1604-17
Signal classification1 categories
Disclosure
4100.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-04-163
Disclosure3
2026-04-171
Disclosure1
Full discourse4 posts
  • Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs
    Disclosure

    CVE-2026-6348 affects the WinMatrix agent by Simopro Technology, allowing an authenticated local attacker to execute arbitrary code. Assessed as Tier 2: high impact Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-04-16/TIER_2_CVE-2026-6348.md #cybersecurity #privilegeescalation #lateralmovement #cve

    Post summary

    CVE-2026-6348 is a high‑impact, authenticated local code‑execution vulnerability in WinMatrix, with no evidence of active exploitation or a published patch at the time of the announcement.

    0001047
    45 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-6348 Missing Authentication in WinMatrix Agent Allows Arbitrary Code Execution With SYSTEM Privileges https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6348

    Post summary

    A new CVE—CVE-2026-6348—has been disclosed, revealing that the WinMatrix Agent lacks authentication and allows an attacker to execute arbitrary code with SYSTEM privileges.

    0000046
    4.0K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-6348 WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability, allowing authenticated local attackers to execute arbitrary code with SYSTEM… https://www.cve.org/CVERecord?id=CVE-2026-6348

    Post summary

    The text discloses CVE-2026-6348, a missing authentication flaw in the WinMatrix agent that allows local, authenticated attackers to run code as SYSTEM, but provides no PoC, exploit code, or evidence of active exploitation.

    0000080
    57.2K followersView on X
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2026-6348: Simopro Technology｜WinMatrix - Mi... Local-to-SYSTEM privilege escalation that spreads across entire WinMatrix environments - one compromised endpoint become... https://zerodaysignal.com/vulnerability/CVE-2026-6348 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    CVE-2026-6348 is announced as a local-to-SYSTEM privilege escalation vulnerability affecting Simopro Technology's WinMatrix platform, potentially impacting all endpoints in connected environments, with no PoC or exploitation code disclosed in this post.

    0000049
    218 followersView on X

Explore more

Back to dashboard