CVE-2026-6348

CVE-2026-6348 is a missing authentication vulnerability in the WinMatrix agent developed by Simopro Technology that permits authenticated local attackers to execute arbitrary code with SYSTEM-level privileges on affected machines and throughout interconnected environments where the agent is deployed. The vulnerability carries a HIGH severity rating (CVSS 8.8) with a local attack vector requiring low complexity and authenticated user access, resulting in complete compromise of confidentiality, integrity, and availability across the affected system and connected infrastructure. Currently, this vulnerability exhibits minimal exploitation activity in the wild, with an extremely low EPSS score of 0.00008 and no inclusion on the CISA Known Exploited Vulnerabilities list, indicating limited active threat exploitation at this time. The Faucet Risk Score of 42.0 suggests moderate organizational concern, though community attention remains relatively low. Organizations running Simopro Technology's WinMatrix agent should prioritize patching efforts given the severity of potential impact, particularly in environments where the agent is widely distributed.