PT-2026-50918 · Winstep · Winstep

Published 2026-06-19 · Updated 2026-06-19 · CVE-2020-37253

Mitre

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Winstep 18.06.0096 contains an unquoted service path vulnerability in the Winstep Xtreme Service that allows local attackers to escalate privileges. Attackers can place malicious executables in the Program Files directory to be executed with LocalSystem privileges when the service starts.

Exploit

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2020-37253

Affected Products

Winstep

References · 3

• 🔥 https://exploit-db.com/exploits/49004 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-37253 · Security Note
• https://vulncheck.com/advisories/winstep-unquoted-service-path-privilege-escalation · Note