# CVE-2026-66109: Sky SKYSEA Client View missing authorization vulnerability

Source: https://junglewise.ai/threats/cve-2026-66109-sky-skysea-client-view-missing-authorization-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-66109 · Severity: high · CVSS 7.8 · Published 2026-08-25

SKYSEA Client View is endpoint management software deployed across Windows corporate networks to monitor and manage devices. A missing authorization check allows any logged-in user to execute arbitrary code with system-level privileges, enabling complete system compromise and potential lateral movement to other managed endpoints.

## Quick answers

**Is CVE-2026-66109 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66109 being exploited in the wild.

**How severe is CVE-2026-66109?** High severity, with a CVSS score of 7.8, published 25 August 2026.

**Which products and versions are affected?** Sky SKYSEA Client View Ver. 21.210.01f and earlier; Sky SKYMEC IT Manager Ver. 2023.225.03a, 2024.005.10a.

**Is there a fix for CVE-2026-66109?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66109 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-66109?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a missing authorization flaw (CWE-862) in SKYSEA Client View and SKYMEC IT Manager that allows privilege escalation. The affected component fails to properly validate that a user has the required privileges before allowing execution of sensitive operations. An attacker with standard user-level access to a Windows system running the affected software can invoke privileged functionality without authentication, resulting in arbitrary code execution with SYSTEM privileges. The vulnerability affects SKYSEA Client View version 21.210.01f and earlier, as well as SKYMEC IT Manager versions 2023.225.03a and 2024.005.10a. Patches and updates are available from Sky Co., Ltd.

## Affected products

- Sky SKYSEA Client View Ver. 21.210.01f and earlier
- Sky SKYMEC IT Manager Ver. 2023.225.03a, 2024.005.10a

## Timeline

- 2026-08-24: disclosed
- 2026-08-25: advisory

## References

- [https://jvn.jp/en/jp/JVN33423625/](https://jvn.jp/en/jp/JVN33423625/)
- [https://www.skyseaclientview.net/news/260824_01/](https://www.skyseaclientview.net/news/260824_01/)