CVE-2016-20086 Overview
CVE-2016-20086 is an unquoted service path vulnerability in Vembu StoreGrid 4.0. The flaw resides in the RemoteBackup and RemoteBackup_webServer Windows services. These services register executable paths that contain spaces but are not enclosed in quotation marks. A local attacker with write access to a parent directory in the service path can drop a malicious executable. Windows will then load the attacker-supplied binary when the service starts, executing code with LocalSystem privileges. The issue is classified under CWE-428 (Unquoted Search Path or Element).
Critical Impact
Local users can escalate to LocalSystem by planting an executable along the unquoted service path and restarting the affected service.
Affected Products
- Vembu StoreGrid 4.0
- RemoteBackup Windows service
- RemoteBackup_webServer Windows service
Discovery Timeline
- 2026-06-19 - CVE-2016-20086 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2016-20086
Vulnerability Analysis
Vembu StoreGrid 4.0 installs two Windows services whose ImagePath registry values contain spaces without surrounding quotation marks. When the Windows Service Control Manager parses an unquoted path that contains spaces, it attempts to execute each space-delimited token as a candidate binary. For an installation path such as C:\Program Files\Vembu\StoreGrid\service.exe, Windows first tries C:\Program.exe, then C:\Program Files\Vembu\StoreGrid.exe, before reaching the intended executable. An attacker who can write to any of these intermediate locations gains control over service startup.
The services run as LocalSystem. Any executable substituted into the unquoted path inherits that token. The result is full local privilege escalation from a low-privileged account to SYSTEM. Public exploitation details are documented in Exploit-DB entry 40582 and the VulnCheck advisory.
Root Cause
The installer registers service binary paths without quoting them. Windows tolerates the syntax but resolves tokens from left to right when spaces are present. The underlying weakness is CWE-428, an unquoted search path. The application does not enforce restrictive ACLs on the parent directories along the path, which compounds the issue.
Attack Vector
The attack requires local access and low-privileged credentials on a host running Vembu StoreGrid 4.0. The attacker places a crafted executable at one of the candidate path positions, for example C:\Program.exe. The attacker then triggers a service restart through a reboot or other means available to the user context. On startup, Windows launches the attacker binary under the LocalSystem account.
The vulnerability is exploited entirely with built-in Windows tooling. No memory corruption, network access, or user interaction is required. See the VulnCheck advisory for the documented exploitation path.
Detection Methods for CVE-2016-20086
Indicators of Compromise
- Presence of executables such as C:\Program.exe or other binaries at intermediate path positions on hosts running Vembu StoreGrid.
- Service start events for RemoteBackup or RemoteBackup_webServer where the resolved process image does not match the expected installation directory.
- New SYSTEM-level processes spawned as children of services.exe with unexpected image paths after a reboot.
Detection Strategies
- Enumerate Windows service ImagePath values and flag entries that contain spaces and are not enclosed in quotation marks. PowerShell Get-WmiObject Win32_Service with a filter on PathName provides a baseline check.
- Audit ACLs on root directories such as C:\ and C:\Program Files to confirm that non-administrative users cannot create files at those locations.
- Hunt for file-creation events targeting candidate path names like Program.exe immediately before a service restart.
Monitoring Recommendations
- Forward Windows Service Control Manager events (Event ID 7045 for new services, 7036 for state changes) to centralized logging for correlation.
- Alert on process creation events (Sysmon Event ID 1) where the parent is services.exe and the image path falls outside expected vendor directories.
- Track file-write events to root volume locations and Program Files parent directories from non-administrative SIDs.
How to Mitigate CVE-2016-20086
Immediate Actions Required
- Inventory all hosts running Vembu StoreGrid 4.0 and identify the unquoted service paths for RemoteBackup and RemoteBackup_webServer.
- Manually quote the affected ImagePath registry values until a vendor-supplied installer fix is applied.
- Restrict write permissions on C:\ and any other parent directories along the service path to administrators only.
Patch Information
No vendor patch reference is published in the available NVD data. Administrators should consult Vembu directly for an updated StoreGrid release that registers quoted service paths. Refer to the VulnCheck advisory and Exploit-DB entry 40582 for technical confirmation of the affected component.
Workarounds
- Edit the service ImagePath registry value under HKLM\SYSTEM\CurrentControlSet\Services\RemoteBackup and RemoteBackup_webServer to wrap the executable path in double quotes, then restart the service.
- Apply NTFS permissions that deny Write access to non-administrative users on every directory in the service path.
- Remove unused local user accounts on StoreGrid hosts to reduce the population of principals capable of exploiting local escalation flaws.
REM Inspect and correct the unquoted service path
sc qc RemoteBackup
sc qc RemoteBackup_webServer
REM After confirming the unquoted value, update the registry entry to wrap the binary path in quotes
REM Example (run as administrator):
reg add "HKLM\SYSTEM\CurrentControlSet\Services\RemoteBackup" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Vembu\StoreGrid\service.exe\"" /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
