CVE-2026-68062: Improper limitation of a pathname to a restricted directory ('Path Traversal') in Sky Co., LTD. SKYSEA Client View

The vulnerability involves improper limitation of a pathname to a restricted directory, enabling path traversal attacks. Exploitation requires the attacker to have login privileges on a Windows system with the affected software installed. Successful exploitation could lead to remote code execution on another Windows system that has the affected products installed and is reachable via UDP packets from the compromised system. This issue is a regression or incomplete fix related to CVE-2024-41726.

An attacker with low privileges on a compromised Windows system can leverage this vulnerability to execute arbitrary code on a second Windows system running the affected software and reachable via UDP. This could lead to full compromise of the target system, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 8.5 (high severity).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a fix is available, restrict login access to systems running the affected software and monitor for suspicious activity involving UDP communications between systems with SKYSEA Client View or SKYMEC IT Manager installed.