PT-2026-3159 · Totalav · Totalav

Andrea Intilangelo · CVE-2021-47787 · Published 2026-01-15 · Updated 2026-02-09

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions TotalAV version 5.15.69

Description TotalAV version 5.15.69 contains an unquoted service path issue in multiple system services running with LocalSystem privileges. An attacker can place malicious executables in specific unquoted path segments, potentially gaining SYSTEM-level access by exploiting the service path configuration.

Recommendations Ensure service paths are properly quoted to prevent the placement of malicious executables.

Exploit

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2021-47787

Affected Products

Totalav

References · 8

• 🔥 https://exploit-db.com/exploits/50314 · Exploit
• https://osv.dev/vulnerability/CVE-2021-47787 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47787 · Security Note
• https://totalav.com · Note
• https://twitter.com/cracbot/status/2013929624741531660 · Twitter Post
• https://vulncheck.com/advisories/totalav-unquoted-service-path · Note
• https://t.me/cveNotify/151402 · Telegram Post
• https://twitter.com/CVEnew/status/2012126502993752495 · Twitter Post