CVE-2022-50914
Published: 13 January 2026
Summary
CVE-2022-50914 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Easeus (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 7.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2022-50914 is an unquoted service path vulnerability (CWE-428) in EaseUS Data Recovery version 15.1.0.0, specifically affecting the EaseUS UPDATE SERVICE executable. Published on 2026-01-13, it carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.
The vulnerability enables a local attacker requiring no privileges to exploit the unquoted path with low complexity and no user interaction. Attackers can inject and execute arbitrary malicious code elevated to LocalSystem privileges, allowing full control over the affected system.
Advisories from Vulncheck detail the unquoted service path issue in ensServer.exe, while a proof-of-concept exploit is publicly available on Exploit-DB (ID 50886). The vendor's site at https://www.easeus.com/ provides additional context, though no specific patch details are outlined in the referenced materials.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2623
Vulnerability details
EaseUS Data Recovery 15.1.0.0 contains an unquoted service path vulnerability in the EaseUS UPDATE SERVICE executable. Attackers can exploit the unquoted path to inject and execute malicious code with elevated LocalSystem privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path (CWE-428) in Windows service directly matches path interception by unquoted path; enables local privilege escalation to SYSTEM via malicious binary placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 mandates timely identification, reporting, and remediation of system flaws such as unquoted service paths, directly preventing exploitation of CVE-2022-50914.
CM-6 requires secure configuration settings for system components, including properly quoted paths for services like ensServer.exe to block malicious code injection.
AC-6 enforces least privilege for service processes, limiting the damage from LocalSystem privilege escalation via the unquoted service path vulnerability.