CVE-2020-35152: Privilege escalation through unquoted service binary path on Cloudflare WARP for Windows

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-03 · updated 2026-06-17
Weakness: CWE-428

Description

Cloudflare WARP for Windows allows privilege escalation due to an unquoted service path. A malicious user or process running with non-administrative privileges can become an administrator by abusing the unquoted service path issue. Since version 1.2.2695.1, the vulnerability was fixed by adding quotes around the service's binary path. This issue affects Cloudflare WARP for Windows, versions prior to 1.2.2695.1.

Affected products

Cloudflare WARP: before 1.2.2695.1 — fixed in 1.2.2695.1

How to fix

Upgrade to a fixed version: Cloudflare WARP 1.2.2695.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-35152 or the next vulnerability affects your stack