What’s Vulnerable › Vulnerabilities

CVE-2016-20061: sheed AntiVirus 2.3 Unquoted Service Path Privilege Escalation

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-04 · updated 2026-07-21
• Weakness: CWE-428

Description

sheed AntiVirus 2.3 contains an unquoted service path vulnerability in the ShavProt service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can insert a malicious executable in the unquoted path and trigger service restart or system reboot to execute code with LocalSystem privileges.

Affected products

• Sheedantivirus sheed AntiVirus: 2.3

References

• http://dl.sheedantivirus.ir/setup.exe
• http://sheedantivirus.ir/
• https://www.exploit-db.com/exploits/40497
• https://www.vulncheck.com/advisories/sheed-antivirus-unquoted-service-path-privilege-escalation

Get alerted when CVE-2016-20061 or the next vulnerability affects your stack