What’s Vulnerable › Vulnerabilities

CVE-2026-6348: Simopro Technology｜WinMatrix - Missing Authentication

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-16 · updated 2026-10-26
• Weakness: CWE-306

Description

WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability, allowing authenticated local attackers to execute arbitrary code with SYSTEM privileges on the local machine as well as on all hosts within the environment where the agent is installed.

Affected products

• Simopro Technology WinMatrix: from 3.5.13 through 3.5.26.15

References

• https://www.twcert.org.tw/en/cp-139-10840-ba9b9-2.html
• https://www.twcert.org.tw/tw/cp-132-10839-2d9a7-1.html

Get alerted when CVE-2026-6348 or the next vulnerability affects your stack