CVE-2020-36927
Published: 16 January 2026
Summary
CVE-2020-36927 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Flexense Diskpulse. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 11.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2020-36927 is an unquoted service path vulnerability in DiskPulse Enterprise 13.6.14. The issue affects the Windows service configuration, specifically the unquoted path 'C:\Program Files\Disk Pulse Enterprise\bin\diskpls.exe'. This flaw, classified under CWE-428, enables local attackers to potentially execute arbitrary code by exploiting the lack of quotes around the service binary path.
A local attacker with low privileges (AV:L/AC:L/PR:L) can exploit the vulnerability by placing a malicious executable in an intermediate directory along the service path, such as C:\Program Files\. When the service starts or restarts, it may execute the attacker's binary instead of the legitimate one, resulting in arbitrary code execution and privilege escalation. The vulnerability yields high impacts on confidentiality, integrity, and availability, as reflected in its CVSS v3.1 base score of 7.8 (S:U/C:H/I:H/A:H).
Advisories and additional resources are available from the vendor at https://www.diskpulse.com, VulnCheck at https://www.vulncheck.com/advisories/diskpulse-unquoted-service-path, and Exploit-DB at https://www.exploit-db.com/exploits/50012, which includes a proof-of-concept exploit. No specific patch or mitigation details are detailed in the primary CVE information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3038
Vulnerability details
DiskPulse Enterprise 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Disk Pulse Enterprise\bin\diskpls.exe' to inject malicious executables and escalate…
more
privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) directly enables path interception by unquoted path for malicious binary execution and resulting local privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unquoted service path flaw by identifying, prioritizing, and correcting the vulnerable service configuration or patching the DiskPulse Enterprise software.
Enforces secure baseline configuration settings for system services, including proper quoting of executable paths like 'C:\Program Files\Disk Pulse Enterprise\bin\diskpls.exe' to prevent path hijacking.
Vulnerability scanning detects unquoted service path issues in Windows services such as the DiskPulse Enterprise service, enabling timely identification and remediation.