PT-2026-3177 · Unknown · Syncbreeze

Brian Rodriguez · Published 2026-01-15 · Updated 2026-01-30 · CVE-2021-47807

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Sync Breeze version 13.6.18

Description Sync Breeze version 13.6.18 contains a security issue due to an unquoted service path in its Windows service configuration. This allows local attackers to potentially execute arbitrary code. The issue stems from the unquoted path in service binaries located in 'Program Files' directories, which enables attackers to inject malicious executables and escalate privileges.

Recommendations Ensure the service path is properly quoted in the Windows service configuration.

Exploit

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2021-47807

Affected Products

Syncbreeze

References · 7

• 🔥 https://exploit-db.com/exploits/50023 · Exploit
• https://osv.dev/vulnerability/CVE-2021-47807 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47807 · Security Note
• https://syncbreeze.com · Note
• https://vulncheck.com/advisories/sync-breeze-multiple-unquoted-service-path · Note
• https://t.me/cveNotify/150347 · Telegram Post
• https://twitter.com/CVEnew/status/2012126485436326136 · Twitter Post