CVE-2020-37100

8.5 highEPSS 0.2%

High (8.5) in flexense syncbreeze. EPSS 0.2% chance of exploitation in the next 30 days.

Sync Breeze Enterprise 12.4.18 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path by placing malicious executables in specific file system locations to hijack the service startup process.

Severity

CVSS 4.0

8.5 high

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-428
Published: 2026-02-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

flexense:syncbreeze

References

http://www.syncbreeze.com
https://www.exploit-db.com/exploits/48045
https://www.vulncheck.com/advisories/sync-breeze-enterprise-unquoted-service-path

Check your stack JSON