CVE-2020-36935
Published: 25 January 2026
Summary
CVE-2020-36935 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Official Kmspico (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2020-36935 is an unquoted service path vulnerability affecting KMSpico version 17.1.0.0, specifically in the configuration of the KMSELDI service. The vulnerability stems from the unquoted binary path C:\Program Files\KMSpico\Service_KMS.exe, which allows local attackers to potentially execute arbitrary code. It is rated with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-428 (Unquoted Search Path).
A local attacker with low privileges can exploit this vulnerability by placing a malicious executable in a directory that the Windows service loader traverses due to the unquoted path. When the KMSELDI service starts or restarts, it may execute the attacker's binary with elevated privileges, enabling privilege escalation, arbitrary code execution, and potential full system compromise.
Advisories from sources like VulnCheck (https://www.vulncheck.com/advisories/kmspico-service-kmseldi-unquoted-service-path) detail the issue, while Exploit-DB (https://www.exploit-db.com/exploits/49003) provides a proof-of-concept exploit. No official patches are referenced for this unofficial software.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4633
Vulnerability details
KMSpico 17.1.0.0 contains an unquoted service path vulnerability in the Service KMSELDI configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path in C:\Program Files\KMSpico\Service_KMS.exe to inject malicious executables and escalate privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unquoted service path in KMSELDI service enables path interception for privilege escalation and arbitrary code execution with SYSTEM rights.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure configuration settings for the KMSELDI service, requiring properly quoted executable paths to directly prevent exploitation of the unquoted service path vulnerability in KMSpico.
Restricts the system to least functionality by disabling unnecessary services like the vulnerable KMSELDI in KMSpico, eliminating the attack vector.
Prohibits user installation of unauthorized software like KMSpico, preventing the deployment of systems with the vulnerable KMSELDI service configuration.