CVE-2016-20087: Fortitude HTTP Privilege Escalation Flaw

CVE-2016-20087 Overview

CVE-2016-20087 affects Fortitude HTTP version 1.0.4.0, a Windows HTTP server product from Network DLS. The vulnerability is an unquoted service path issue [CWE-428] in the registered Windows service binary. A local authenticated attacker can place a malicious executable along the unquoted path so Windows loads it instead of the legitimate service binary. The injected binary runs with the privileges of the service account, typically SYSTEM, on service start or system reboot. This converts a low-privileged local account into a full system compromise without exploiting any memory corruption.

Critical Impact
Local users can escalate to SYSTEM privileges by planting an executable in an unquoted path segment used by the Fortitude HTTP Windows service.

Affected Products

Fortitude HTTP 1.0.4.0
Network DLS Fortitude HTTP service binary on Windows
Windows installations running the vulnerable service with default unquoted path configuration

Discovery Timeline

2026-06-19 - CVE-2016-20087 published to the National Vulnerability Database
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2016-20087

Vulnerability Analysis

The flaw is a classic Windows unquoted service path issue classified under [CWE-428] (Unquoted Search Path or Element). When Windows registers a service with an ImagePath containing spaces but no surrounding quotation marks, the Service Control Manager tokenizes the path on each space. It then attempts to launch each truncated candidate as an executable until one succeeds.

An attacker who can write to any directory in the tokenized path can drop a binary that Windows will execute before reaching the intended service binary. Because services in this class run as LocalSystem, the planted binary inherits SYSTEM-level rights. Exploitation requires only local code execution and write access to a directory along the path, which is the precondition reflected in the local attack vector and low privileges metrics.

Root Cause

The Fortitude HTTP installer registers the service with an unquoted ImagePath value pointing into a directory tree that contains spaces, such as C:\Program Files\.... Windows interprets each space as a possible terminator and searches for executables like C:\Program.exe before resolving the full path. The vendor did not wrap the binary path in quotation marks in the service registration, which is the underlying defect.

Attack Vector

A local user with write permissions to a vulnerable directory (for example, the root of the system drive on misconfigured hosts) drops a payload named to match a path token. On the next service restart or reboot, the Service Control Manager launches the attacker-controlled executable as SYSTEM. A public proof of concept is documented in Exploit-DB #40461 and the Vulncheck advisory.

// No verified exploit code reproduced here.
// See Exploit-DB #40461 for the published proof of concept.

Detection Methods for CVE-2016-20087

Indicators of Compromise

Unexpected executables in directories along the system drive root or Program Files parent paths, such as C:\Program.exe.
Windows service registrations for Fortitude HTTP where the ImagePath registry value lacks surrounding quotation marks.
New SYSTEM-owned processes spawned by services.exe whose image path does not match the installed Fortitude HTTP binary location.

Detection Strategies

Audit the HKLM\SYSTEM\CurrentControlSet\Services hive for any service whose ImagePath contains spaces but no quotes, using PowerShell or wmic service get name,pathname.
Monitor process creation events (Windows Event ID 4688 or Sysmon Event ID 1) where the parent is services.exe and the image path is outside expected install directories.
Alert on file creation events in C:\, C:\Program Files, or other path-token locations for executables that do not match an approved software inventory.

Monitoring Recommendations

Track changes to service configuration with Windows Event ID 7045 (new service installed) and 4697 (service installation logged) and review for unquoted paths.
Forward Sysmon process and file telemetry to a centralized analytics platform to correlate SYSTEM-level executions with prior file drops by non-privileged users.

How to Mitigate CVE-2016-20087

Immediate Actions Required

Inventory all Windows hosts running Fortitude HTTP 1.0.4.0 and identify services with unquoted ImagePath values.
Restrict write permissions on the root of the system drive and other path-token directories so non-administrative users cannot drop executables.
Remove or replace Fortitude HTTP 1.0.4.0 where a fixed release is not available from Network DLS.

Patch Information

No vendor patch is referenced in the available advisory data. Consult the Network DLS Fortitude HTTP product page and the Vulncheck advisory for the latest vendor guidance and any subsequent release that quotes the service binary path.

Workarounds

Manually correct the registry value at HKLM\SYSTEM\CurrentControlSet\Services\<FortitudeService>\ImagePath to wrap the full executable path in quotation marks, then restart the service.
Apply least-privilege ACLs to the system drive root and any parent directory referenced by the service path so only administrators can write executables there.
Disable the Fortitude HTTP service on hosts where it is not required until configuration is remediated.

bash

# PowerShell: enumerate services with unquoted paths containing spaces
Get-WmiObject Win32_Service |
  Where-Object { $_.PathName -notmatch '^"' -and $_.PathName -match ' ' } |
  Select-Object Name, DisplayName, PathName, StartMode, StartName