Sky Co. IT Tools Vulnerable to Privilege Escalation Flaw
AI-generated from multiple sources. Verify before acting on this reporting.
TOKYO — A critical security vulnerability in enterprise IT asset management software developed by Sky Co., LTD. allows non-administrative users to execute code with elevated privileges, the company confirmed on Sunday.
The flaw affects two of the company's primary products, SKYSEA Client View and SKYMEC IT Manager. Security researchers identified that improper file access permission settings within the software's installation directory enable unauthorized manipulation of system files. The vulnerability is classified as incorrect default permissions, a known weakness that can lead to privilege escalation.
Sky Co., LTD. stated that the issue stems from the default configuration of the software upon installation. Because the installation folder grants excessive access rights, users without administrative credentials can modify critical files. This access allows attackers to inject and execute arbitrary code, effectively bypassing standard security controls and gaining full control over the affected systems.
The vulnerability was disclosed on April 20, 2026. Sky Co. has acknowledged the severity of the issue, noting that it impacts organizations relying on these tools for IT asset management across Japan and other regions where the software is deployed. The company is currently working to release patches to correct the permission settings and secure the installation directories.
SKYSEA Client View and SKYMEC IT Manager are widely used for monitoring and managing hardware and software assets within corporate networks. The exposure of administrative privileges through these tools presents a significant risk to enterprise security infrastructure. If exploited, the flaw could allow malicious actors to install malware, exfiltrate sensitive data, or disrupt critical business operations.
Security experts have advised administrators to review their current installations immediately. Until a patch is deployed, organizations are urged to manually restrict file permissions on the installation folders to prevent unauthorized access. The specific steps for manual mitigation vary depending on the operating system and the version of the software in use.
Sky Co. has not yet specified a timeline for the release of a permanent fix. The company is coordinating with affected clients to ensure awareness of the vulnerability and the necessary interim measures. Questions remain regarding the extent of the software's deployment and whether any active exploitation has occurred prior to the disclosure.
The incident highlights the ongoing risks associated with default configurations in enterprise software. Developers are increasingly scrutinized for ensuring secure-by-default settings to prevent similar vulnerabilities from compromising organizational security. Sky Co. is expected to provide further updates as the remediation process progresses.