Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.5

Unquoted service path in KiteService allows local code execution

CVE-2020-36958 · published 9 months ago
Summary

The KiteService in Kite 1.2020.1119.0 has a security flaw that lets local attackers run their own code on the system. This could allow them to take control of the computer. To fix this, update to the latest version of Kite or ensure the service path is properly quoted.

Original advisory text
Kite 1.2020.1119.0 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the un...
Kite 1.2020.1119.0 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Kite\KiteService.exe' to inject malicious executables and escalate privileges on the system.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-428Unquoted Search Path or Element
Timeline
Published26 Jan 2026
Updated26 Oct 2026
First seen7 Mar 2026
Sources
CVE-2020-36958 · NVD
Track software like this
Free during beta