Loading story…
A high-severity privilege-escalation flaw tracked as CVE-2021-47985 affects SAPSprint 7.60 on Windows by using an unquoted service path in the SAPSprint service configuration. The vulnerable binary path, C:\Program Files\SAP\SAPSprint\sapsprint.exe, can be abused by a local attacker who places a malicious executable in a searched path location, causing Windows to launch attacker-controlled code when the service starts. The service is configured to start automatically and runs as LocalSystem, making successful exploitation a path to full local privilege escalation.
The issue was previously documented in an Exploit-DB entry by Brian Rodriguez, which described testing on Windows 10 Enterprise 64-bit and noted the absence of a CVE at the time. The newer CVE record classifies the bug as not remotely exploitable but rates it High severity, with CVSS 3.1 7.8 and CVSS 4.0 8.5. Recommended mitigation includes quoting the service path, restricting write access in the affected directories, and monitoring for unauthorized executable placement in locations that Windows may search during service startup.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A CVE entry for CVE-2021-47985 was published describing the SAPSprint 7.60 unquoted service path privilege-escalation vulnerability, rating it High severity and recommending quoting and protecting the service path. The entry states the flaw is local-only and attributes the source to VulnCheck.
Exploit-DB published an entry documenting an unquoted service path vulnerability in SAPSprint 7.60 on Windows that could allow local privilege escalation via path hijacking in the SAPSprint service running as LocalSystem. The entry credits Brian Rodriguez as the discoverer and notes testing on Windows 10 Enterprise 64-bit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed several **Windows Simple Search and Discovery Protocol (SSDP) Service** elevation-of-privilege vulnerabilities, including `CVE-2026-32082`, `CVE-2025-48815`, `CVE-2025-47975`, and `CVE-2025-59196`, indicating a recurring security issue affecting the Windows SSDP component. The advisories identify the flaws as local privilege-escalation bugs that could allow an attacker with existing low-privilege access to gain **administrator-level** rights on a vulnerable system. For `CVE-2026-32082`, Microsoft said the issue stems from a **race condition** (`CWE-362`) and rated it **Important** with a **CVSS 3.1 score of 7.0**. The company described exploitation as requiring local access and low privileges, with **high impact** to confidentiality, integrity, and availability if successful. Microsoft said exploitation was considered less likely, was not publicly disclosed or known to be exploited at publication, and that a security update was available.
Jun 29, 2026
A high-severity privilege escalation vulnerability tracked as **CVE-2023-54353** affects **Chromacam 4.0.3.0** through an unquoted Windows service path in `PsyFrameGrabberService`. The service binary is configured as `C:\Program Files (x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe` without quotation marks, while the service starts automatically and runs with **LocalSystem** privileges. An attacker with existing local access and the ability to write to affected directories can abuse Windows path parsing to place a malicious executable and have it launched with elevated rights when the service starts. Public exploit details published on Exploit-DB describe planting files such as `Program.exe` or a rogue `PsyFrameGrabberService.exe` in writable locations including `C:\` or parts of `C:\Program Files (x86)\Personify\`. The issue is rated **8.5** under **CVSS 4.0** and **7.8** under **CVSS 3.1**, and is described as not remotely exploitable because it requires local write access. Recommended remediation is to properly quote the `PsyFrameGrabberService` path and verify the service configuration after the change.
Jun 29, 2026
Microsoft has disclosed a critical elevation-of-privilege vulnerability in the Windows Kernel, tracked as CVE-2025-62215, which is being actively exploited in the wild. The flaw arises from a race condition and improper memory management, specifically a double-free scenario, allowing local attackers to escalate privileges to SYSTEM level. Exploitation requires an attacker to already have access to the system, but no user interaction is needed, and the attack can be automated. Microsoft has rated the vulnerability as Important, with a CVSS score of 7.0, and notes that all supported Windows 10 editions are affected, including those under Extended Security Updates (ESU). No workaround is available other than applying the official update, and immediate patching is strongly recommended. The vulnerability is classified under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and CWE-415 (Double Free), making it a classic post-compromise privilege escalation vector. Attackers can exploit the timing-sensitive memory corruption path in the kernel to gain elevated access, disable security defenses, and move laterally within networks. The attack surface is particularly concerning in enterprise environments where multiple users share access, as any authenticated user can potentially trigger the exploit. Security experts warn that both targeted threat actors and ransomware operators may leverage this flaw to deepen their foothold after initial access, emphasizing the urgency of deploying the security update across all affected systems.
Jul 12, 2026