CVE-2021-47859
Published: 21 January 2026
Summary
CVE-2021-47859 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Hidglobal (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2021-47859 is an unquoted service path vulnerability affecting ActivIdentity 8.2, specifically in the ac.sharedstore service. The issue stems from an unquoted binary path located at C:\Program Files\Common Files\ActivIdentity\, which enables local attackers to potentially execute arbitrary code by placing malicious executables in that directory. The vulnerability is rated with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-428.
Local low-privileged attackers can exploit this vulnerability by injecting a malicious executable into the specified path, leveraging the unquoted service path during service startup to execute arbitrary code and escalate privileges, achieving high confidentiality, integrity, and availability impacts.
Advisories and resources, including an exploit at https://www.exploit-db.com/exploits/49703, vendor information from HID Global at https://www.hidglobal.com/, and a detailed advisory from Vulncheck at https://www.vulncheck.com/advisories/actividentity-acsharedstore-unquoted-service-path, provide further context on the issue, though specific mitigation steps are outlined in those references. The vulnerability was published on 2026-01-21T18:16:16.920.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3633
Vulnerability details
ActivIdentity 8.2 contains an unquoted service path vulnerability in the ac.sharedstore service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path in C:\Program Files\Common Files\ActivIdentity\ to inject malicious executables and escalate privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in Windows service directly enables path interception by unquoted path for local privilege escalation via malicious executable placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unquoted service path flaw through timely identification, reporting, and patching of the vulnerability in the ac.sharedstore service.
Enforces secure configuration settings for services, including proper quoting of executable paths with spaces to prevent path hijacking exploitation.
Restricts software execution to authorized programs only via deny-by-default whitelisting, blocking malicious executables injected to exploit the unquoted service path.