CVE-2021-47886
Published: 21 January 2026
Summary
CVE-2021-47886 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Pingzapper (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2021-47886 is an unquoted service path vulnerability in Pingzapper version 2.3.1, affecting the PingzapperSvc service. The issue arises from the unquoted service path 'C:\Program Files (x86)\Pingzapper\PZService.exe', which corresponds to CWE-428. This flaw allows local attackers to potentially execute arbitrary code by exploiting the vulnerability in the Windows service configuration.
Local attackers with low privileges (PR:L) can exploit this vulnerability with low attack complexity (AC:L), local access (AV:L), and no user interaction (UI:N) required, as reflected in its CVSS v3.1 base score of 7.8 (High). Exploitation involves placing malicious executables in directories traversed before the legitimate service binary, enabling privilege escalation upon service restart or execution.
Advisories and resources, including the Vulncheck advisory at https://www.vulncheck.com/advisories/pingzapper-pingzappersvc-unquoted-service-path, provide further details on the vulnerability. A proof-of-concept exploit is publicly available at https://www.exploit-db.com/exploits/49626. Vendor information is accessible via https://pingzapper.com and https://pingzapper.com/download.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3617
Vulnerability details
Pingzapper 2.3.1 contains an unquoted service path vulnerability in the PingzapperSvc service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files (x86)\Pingzapper\PZService.exe' to inject malicious executables and escalate privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path directly enables path interception by unquoted path (T1574.009) for local privilege escalation (T1068) via malicious binary placement before service executable.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces and maintains secure configuration settings for system services, including proper quoting of executable paths to directly prevent exploitation of unquoted service path vulnerabilities like CVE-2021-47886.
Requires timely identification, reporting, and remediation of system flaws, directly addressing the unquoted service path vulnerability in PingzapperSvc exploited by CVE-2021-47886.
Mandates vulnerability scanning that identifies unquoted service path issues like CVE-2021-47886 in Windows services such as PingzapperSvc.