PT-2026-5113 · Unknown · Program Access Controller

Mohammed Alshehri · CVE-2020-36987 · Published 2026-01-28 · Updated 2026-01-28

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Program Access Controller version 1.2.0.0

Description Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted path during system startup or reboot to inject and run malicious executables with LocalSystem permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2020-36987

Affected Products

Program Access Controller

References · 6

• 🔥 https://exploit-db.com/exploits/48966 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36987 · Security Note
• https://t.me/cveNotify/150130 · Telegram Post
• https://gearboxcomputers.com · Note
• https://t.me/CVEtracker/43144 · Telegram Post
• https://vulncheck.com/advisories/program-access-controller-pacserviceexe-unquoted-service-path · Note