CVE-2026-39454

CVE-2026-39454 is a privilege escalation vulnerability affecting SKYSEA Client View and SKYMEC IT Manager by Sky Co., Ltd., stemming from improper file access permissions in the installation folder. Non-administrative users can place arbitrary files within the installation directory, leading to execution of malicious code with administrative privileges. This represents a direct path from limited user access to complete system compromise through a local attack vector. The vulnerability carries a HIGH CVSS score of 7.8 with a local attack vector, low attack complexity, and low privilege requirements, indicating it can be exploited by any authenticated user without special conditions. The impact is severe across all dimensions: confidentiality, integrity, and availability are all rated high, as successful exploitation grants administrative code execution. The FAUCET Risk Score of 49.0 out of 100 reflects moderate concern within the broader threat landscape. There is currently no evidence of active exploitation or public exploit code availability. The vulnerability has not been added to known exploitation lists (KEV status shows "No"), and the EPSS score of 0.00013 indicates minimal probability of exploitation in the wild relative to other vulnerabilities. However, organizations using these Sky products should prioritize patching, as the straightforward nature of the attack vector means exploitation could become attractive once public disclosure increases awareness.