CVE-2026-6348 CRITICAL

CVE-2026-6348: Simopro Technology｜WinMatrix - Missing Authentication

Vendor Simopro Technology
Product WinMatrix
Weakness CWE-306 · Missing auth
Published April 16, 2026
Last update April 16, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability, allowing authenticated local attackers to execute arbitrary code with SYSTEM privileges on the local machine as well as on all hosts within the environment where the agent is installed.

Key dates

02Disclosure timeline

April 16, 2026 CVE published
April 16, 2026 Record updated