CVE-2026-6348

High

Published: 16 April 2026

Published

16 April 2026

Modified

17 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0001 0.7th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-6348 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Org (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

Directly mitigates the missing authentication vulnerability by identifying and prohibiting critical actions, such as arbitrary code execution, without identification and authentication in the WinMatrix agent.

AC-3 Access Enforcement good match

prevent

Ensures the WinMatrix agent enforces approved authorizations, preventing low-privilege local attackers from executing arbitrary code with SYSTEM privileges.

AC-6 Least Privilege partial match

prevent

Limits the scope and impact of privilege escalation from the missing authentication flaw by restricting the agent to least privilege necessary for its management functions across hosts.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

The vulnerability is a local missing authentication flaw in a management agent that allows low-privileged authenticated users to execute arbitrary code as SYSTEM, directly enabling T1068 Exploitation for Privilege Escalation with scope change to other hosts.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability, allowing authenticated local attackers to execute arbitrary code with SYSTEM privileges on the local machine as well as on all hosts within the environment where the agent is installed.

Deeper analysisAI

CVE-2026-6348 is a Missing Authentication vulnerability (CWE-306) in the WinMatrix agent developed by Simopro Technology. This flaw affects the agent software, which is deployed for management purposes across environments. Published on 2026-04-16, it carries a CVSS v3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to its potential for significant impact with relatively low barriers to exploitation.

The vulnerability enables authenticated local attackers with low privileges to execute arbitrary code with SYSTEM-level privileges. Exploitation occurs locally (AV:L) with low complexity and no user interaction required, but the scope is changed (S:C), allowing attackers to elevate privileges not only on the local machine but also across all hosts in the environment where the WinMatrix agent is installed. Successful exploitation grants full control, compromising confidentiality, integrity, and availability at a high level.

Advisories are available from TWCERT at https://www.twcert.org.tw/en/cp-139-10840-ba9b9-2.html and https://www.twcert.org.tw/tw/cp-132-10839-2d9a7-1.html, which detail the issue but do not specify mitigation steps in the provided information.