# CVE-2026-68062: Sky SKYSEA Client View and SKYMEC IT Manager path traversal

Source: https://junglewise.ai/threats/cve-2026-68062-sky-skysea-client-view-and-skymec-it-manager-path-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-68062 · Severity: high · CVSS 8.5 · Published 2026-08-25

SKYSEA Client View and SKYMEC IT Manager are Windows-based IT administration and endpoint management tools used by organizations to manage client computers and security policies. This path traversal vulnerability allows an attacker who has logged into a Windows system with these products installed to execute arbitrary code on other networked Windows systems running the affected software, provided those systems can receive UDP packets. This represents a significant lateral movement risk in enterprise environments.

## Quick answers

**Is CVE-2026-68062 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-68062 being exploited in the wild.

**How severe is CVE-2026-68062?** High severity, with a CVSS score of 8.5, published 25 August 2026.

**Which products and versions are affected?** Sky SKYSEA Client View 19.300.09h through 21.210.01f; Sky SKYMEC IT Manager 2024.005.10a.

**Is there a fix for CVE-2026-68062?** A patch was published on 2026-08-24: SKYSEA Client View 21.310.01a and later; SKYMEC IT Manager fixes available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-68062 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-68062?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a path traversal (CWE-22) that results from an incomplete fix for a previous vulnerability (CVE-2024-41726). The flaw allows an authenticated local attacker to craft malicious input that bypasses file path validation, enabling arbitrary code execution on remote systems via UDP communication. The attack requires the attacker to have login access to a Windows system where the product is installed, and the target system must be able to receive UDP packets from that system. Patches are available from the vendor; SKYSEA Client View users should update to version 21.310.01a or later, and SKYMEC IT Manager users should apply the provided fix module.

## Affected products

- Sky SKYSEA Client View 19.300.09h through 21.210.01f
- Sky SKYMEC IT Manager 2024.005.10a

## Timeline

- 2026-08-24: disclosed
- 2026-08-25: advisory
- 2026-08-24: patched: SKYSEA Client View 21.310.01a and later; SKYMEC IT Manager fixes available

## References

- [https://jvn.jp/en/jp/JVN33423625/](https://jvn.jp/en/jp/JVN33423625/)
- [https://www.skyseaclientview.net/news/260824_01/](https://www.skyseaclientview.net/news/260824_01/)