How to fix CVE-2020-36958?

Within 24 hours: Inventory all systems running KiteService and assess exposure; isolate or restrict network access to affected systems. Within 7 days: Implement network segmentation to limit lateral movement from compromised KiteService instances; disable KiteService if not operationally critical. Within 30 days: Evaluate alternative solutions or vendor roadmap for patching; establish monitoring for exploitation attempts; consider OS hardening and privilege restrictions on affected systems.

Is Windows affected by CVE-2020-36958?

A high-severity vulnerability in KiteService Windows service (CVE-2020-36958) could allow attackers to execute arbitrary code on affected systems, potentially compromising critical infrastructure and sensitive data.

CVE-2020-36958

HIGH

2026-01-26 [email protected]

7.8

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

PoC Detected

Jan 27, 2026 - 14:59 vuln.today

Public exploit code

CVE Published

Jan 26, 2026 - 18:16 nvd

HIGH 7.8

Description

Kite 1.2020.1119.0 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Kite\KiteService.exe' to inject malicious executables and escalate privileges on the system.

Analysis

KiteService Windows service contains a vulnerability that allows attackers to potentially execute arbitrary code (CVSS 7.8).

Technical Context

exists in the KiteService Windows component. Kite 1.2020.1119.0 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Kite\KiteService.exe' to inject malicious executables and escalate privileges on the system.

Affected Products

Product: KiteService Windows service. Component: KiteService Windows.

Remediation

Monitor vendor advisories for a patch.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.0

CVSS: +39

POC: +20

CVE-2020-36958 vulnerability details – vuln.today

Back

CVE-2020-36958

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2020-36958

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code