Windows CVE-2026-33253

|

EUVD

EUVD-2026-15192 HIGH

Unquoted Search Path or Element (CWE-428)

2026-03-25 jpcert

GHSA-8745-x4ph-xhpc

RCE Microsoft Windows

8.4

CVSS 4.0 · NVD

Share

Severity by source

NVD PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

X

Lifecycle Timeline

3

EUVD ID Assigned

Mar 25, 2026 - 05:45 euvd

EUVD-2026-15192

Analysis Generated

Mar 25, 2026 - 05:45 vuln.today

CVE Published

Mar 25, 2026 - 05:11 nvd

HIGH 8.4

DescriptionCVE.org

SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

AnalysisAI

A remote code execution vulnerability (CVSS 8.4). High severity vulnerability requiring prompt remediation.

Technical ContextAI

Vulnerability type: remote code execution. CVSS 8.4 indicates high severity.

RemediationAI

Monitor vendor channels for patch availability.

More in Windows

View all

CVE-2019-0803 HIGH Act Now POC

Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in

CVE-2020-1472 MEDIUM Act Now POC

A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr

CVE-2025-33053 HIGH Act Now POC

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables

CVE-2025-33073 HIGH Act Now POC

Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker

CVE-2025-13315 CRITICAL Emergency POC

Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b

CVE-2013-10047 CRITICAL Emergency POC

An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote

CVE-2012-10030 CRITICAL Emergency POC

FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit

CVE-2025-34101 CRITICAL Emergency POC

Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio

CVE-2025-13316 HIGH Act Now POC

Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred

CVE-2025-34095 CRITICAL Emergency POC

Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/

CVE-2025-11953 CRITICAL Act Now POC

React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo

CVE-2025-24054 MEDIUM This Month POC

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network

Same weakness CWE-428 – Unquoted Search Path or Element

View all

CVE-2022-50935 CRITICAL POC

CVE-2023-38408 CRITICAL POC

CVE-2025-71326 HIGH POC

CVE-2016-20090 HIGH POC

CVE-2016-20089 HIGH POC

CVE-2020-37252 HIGH POC

CVE-2023-54353 HIGH POC

CVE-2020-37254 HIGH POC

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

CVE-2017-7269 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2023-3519 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2016-4117 CRITICAL POC

CVE-2015-3113 CRITICAL POC

Share

CVE-2026-33253 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy