CVE-2026-6348
Published: 16 April 2026
Summary
CVE-2026-6348 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Org (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 7.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-6348 is a Missing Authentication vulnerability (CWE-306) in the WinMatrix agent developed by Simopro Technology. This flaw affects the agent software, which is deployed for management purposes across environments. Published on 2026-04-16, it carries a CVSS v3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to its potential for significant impact with relatively low barriers to exploitation.
The vulnerability enables authenticated local attackers with low privileges to execute arbitrary code with SYSTEM-level privileges. Exploitation occurs locally (AV:L) with low complexity and no user interaction required, but the scope is changed (S:C), allowing attackers to elevate privileges not only on the local machine but also across all hosts in the environment where the WinMatrix agent is installed. Successful exploitation grants full control, compromising confidentiality, integrity, and availability at a high level.
Advisories are available from TWCERT at https://www.twcert.org.tw/en/cp-139-10840-ba9b9-2.html and https://www.twcert.org.tw/tw/cp-132-10839-2d9a7-1.html, which detail the issue but do not specify mitigation steps in the provided information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23163
Vulnerability details
WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability, allowing authenticated local attackers to execute arbitrary code with SYSTEM privileges on the local machine as well as on all hosts within the environment where the agent is installed.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a local missing authentication flaw in a management agent that allows low-privileged authenticated users to execute arbitrary code as SYSTEM, directly enabling T1068 Exploitation for Privilege Escalation with scope change to other hosts.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the missing authentication vulnerability by identifying and prohibiting critical actions, such as arbitrary code execution, without identification and authentication in the WinMatrix agent.
Ensures the WinMatrix agent enforces approved authorizations, preventing low-privilege local attackers from executing arbitrary code with SYSTEM privileges.
Limits the scope and impact of privilege escalation from the missing authentication flaw by restricting the agent to least privilege necessary for its management functions across hosts.