CVE-2021-47864
Published: 21 January 2026
Summary
CVE-2021-47864 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-47864 is an unquoted service path vulnerability affecting OSAS Traverse Extension 11, specifically in the TravExtensionHostSvc service that runs with LocalSystem privileges. This flaw, classified under CWE-428, allows attackers to exploit the unquoted path by placing malicious executable files along the service's search path, leading to arbitrary code execution. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-01-21.
A local attacker with low privileges can exploit this vulnerability by creating directories and dropping a malicious executable in locations that the Windows service control manager searches before the legitimate service binary. Upon service restart or startup, the malicious code executes with LocalSystem privileges, enabling high confidentiality, integrity, and availability impacts, such as full system compromise.
Advisories and references, including the Vulncheck advisory on the OSAS Traverse Extension TravExtensionHostSvc unquoted service path, an Exploit-DB entry (49698) demonstrating exploitation, and an archived OSAS website, provide further details on the issue, though specific patch or mitigation guidance is not detailed in the core description.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3634
Vulnerability details
OSAS Traverse Extension 11 contains an unquoted service path vulnerability in the TravExtensionHostSvc service running with LocalSystem privileges. Attackers can exploit the unquoted path to inject and execute malicious code by placing executable files in the service's path, potentially gaining…
more
elevated system access.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in LocalSystem service directly matches path interception by unquoted path; enables local privilege escalation to SYSTEM via malicious binary placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and correction of the unquoted service path flaw in TravExtensionHostSvc to prevent exploitation.
Enforces baseline configuration settings for services, including quoted executable paths and protected search directories, to block path hijacking by local attackers.
Applies least privilege to service accounts, reducing the impact of LocalSystem privilege escalation if the unquoted path is exploited.