Login Request a demo
High severity · published Feb 3, 2026
CVE-2020-37100
Sync Breeze Enterprise 12.4.18 - Unquoted Service Path
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Sync Breeze Enterprise 12.4.18 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path by placing malicious executables in specific file system locations to hijack the service startup process.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
Sync Breeze Enterprise · SyncBreeze
12.4.18 · source: vendor
SY
Syncbreeze · Flexense
12.4.18 · source: NVD
Affected product
SB
Sync Breeze Enterprise
SyncBreeze
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37100
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37100
Product
http://www.syncbreeze.com
Exploit
https://www.exploit-db.com/exploits/48045
Third Party Advisory
https://www.vulncheck.com/advisories/sync-breeze-enterprise-unquoted-service-path