What is the CVSS score of CVE-2020-36958?

CVE-2020-36958 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2020-36958?

A high-severity vulnerability in KiteService Windows service (CVE-2020-36958) could allow attackers to execute arbitrary code on affected systems, potentially compromising critical infrastructure and…

Is there a public PoC exploit available for CVE-2020-36958?

Yes, a public proof-of-concept exploit is available for CVE-2020-36958. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2020-36958?

Within 24 hours: Inventory all systems running KiteService and assess exposure; isolate or restrict network access to affected systems. Within 7 days: Implement network segmentation to limit lateral movement from compromised KiteService instances; disable KiteService if not operationally critical. Within 30 days: Evaluate alternative solutions or vendor roadmap for patching; establish monitoring for exploitation attempts; consider OS hardening and privilege restrictions on affected systems.

Windows CVE-2020-36958

HIGH

Unquoted Search Path or Element (CWE-428)

2026-01-26 disclosure@vulncheck.com

Windows

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

PoC Detected

Jan 27, 2026 - 14:59 vuln.today

Public exploit code

CVE Published

Jan 26, 2026 - 18:16 nvd

HIGH 7.8

DescriptionCVE.org

Kite 1.2020.1119.0 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Kite\KiteService.exe' to inject malicious executables and escalate privileges on the system.

AnalysisAI

KiteService Windows service contains a vulnerability that allows attackers to potentially execute arbitrary code (CVSS 7.8).

Technical ContextAI

exists in the KiteService Windows component. Kite 1.2020.1119.0 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Kite\KiteService.exe' to inject malicious executables and escalate privileges on the system.