CVE-2021-47826
Published: 16 January 2026
Summary
CVE-2021-47826 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Acer Backup Manager (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2021-47826 is an unquoted service path vulnerability affecting Acer Backup Manager version 3.0.0.99, specifically in the NTI IScheduleSvc service. The flaw, classified under CWE-428, stems from an improperly quoted executable path registered as "C:\Program Files (x86)\NTI\Acer Backup Manager\", enabling potential arbitrary code execution. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact with local access.
Local users with low privileges can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate service binary in the system's PATH search order, such as within C:\Program Files (x86)\NTI\. Upon service restart or system boot, the injected executable runs with elevated LocalSystem privileges, granting attackers high confidentiality, integrity, and availability impacts.
Advisories and references, including those from VulnCheck and Exploit-DB, document the unquoted path issue in the IScheduleSvc.exe module, with a proof-of-concept exploit available at https://www.exploit-db.com/exploits/49889. Additional details can be found at https://www.vulncheck.com/advisories/acer-backup-manager-module-ischedulesvcexe-unquoted-service-path and Acer's support site at https://www.acer.com/ac/en/US/content/home; no specific patch details are outlined in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2888
Vulnerability details
Acer Backup Manager 3.0.0.99 contains an unquoted service path vulnerability in the NTI IScheduleSvc service that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files (x86)\NTI\Acer Backup Manager\ to inject malicious executables…
more
that would run with elevated LocalSystem privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in Windows service directly enables path interception for privilege escalation by allowing malicious executable placement in PATH search order.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure configuration settings for services, including proper quoting of executable paths with spaces to directly prevent unquoted service path exploitation.
Requires timely identification, prioritization, and correction of the specific unquoted service path flaw in Acer Backup Manager's NTI IScheduleSvc.
Implements application whitelisting with deny-all, permit-by-exception policy to block execution of unauthorized malicious executables placed in intermediate directories.