What’s Vulnerable › Vulnerabilities

CVE-2020-37253: Winstep 18.06.0096 Unquoted Service Path Privilege Escalation

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-19 · updated 2026-10-06
• Weakness: CWE-428

Description

Winstep 18.06.0096 contains an unquoted service path vulnerability in the Winstep Xtreme Service that allows local attackers to escalate privileges. Attackers can place malicious executables in the Program Files directory to be executed with LocalSystem privileges when the service starts.

Affected products

• Winstep: 18.06.0096

References

• https://www.exploit-db.com/exploits/49004
• https://www.vulncheck.com/advisories/winstep-unquoted-service-path-privilege-escalation

Get alerted when CVE-2020-37253 or the next vulnerability affects your stack