PT-2026-33248 · Unknown · Winmatrix Agent

Published 2026-04-16 · Updated 2026-04-16 · CVE-2026-6348

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WinMatrix agent (affected versions not specified)

Description A missing authentication flaw allows authenticated local attackers to execute arbitrary code with SYSTEM privileges on the local machine. This issue can lead to privilege escalation that spreads across all hosts within the environment where the agent is installed, potentially allowing a single compromised endpoint to affect the entire network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-6348

Affected Products

Winmatrix Agent

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-6348 · Security Note
• https://twcert.org.tw/tw/cp-132-10839-2d9a7-1.html · Note
• https://twitter.com/0dayPublishing/status/2044610409177420008 · Twitter Post
• https://twitter.com/CVEnew/status/2044701591677390988 · Twitter Post
• https://twcert.org.tw/en/cp-139-10840-ba9b9-2.html · Note