CVE-2016-20086CWE-428

CVE-2016-20086

High · published June 19, 2026

CVSS v3.1

7.8

EPSS

Percentile

5.8

In the wild

Unconfirmed

What it is

Vembu StoreGrid 4.0 contains an unquoted service path vulnerability in the RemoteBackup and RemoteBackup_webServer services that allows local attackers to escalate privileges. Attackers can place a malicious executable in the unquoted path and restart the service to execute code with LocalSystem privileges.

The record

Technical detail

CVSS v3.1: 7.8 · HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00168 · 5.8th percentile
Weakness: CWE-428 · Unquoted Search Path or Element
Published: 2026-06-19T19:16Z

References (2)

https://www.exploit-db.com/exploits/40582 · [email protected]https://www.vulncheck.com/advisories/vembu-storegrid-unquoted-service-path-privilege-escalation · [email protected]

EPSS history

Timeline

19 JUN 14:16Z
Vembu StoreGrid 4.0 Unquoted Service Path Privilege Escalation
cvelistv5