High severity · published Jun 26, 2026
CVE-2026-8797
An access control deficiency vulnerability exists in ExpressUpdate Agent for Windows
8.5
CVSS
0.1%
EPSS
No
On KEV
Description
An access control deficiency vulnerability exists in ExpressUpdate Agent for Windows. If a malicious user gains access to the product, arbitrary code could be executed with SYSTEM privileges.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
ExpressUpdate Agent for Windows · NEC Corporation
3.24 and prior · source: vendor
Affected product
EA
ExpressUpdate Agent for Windows
NEC Corporation