CVE-2021-47859: ActivIdentity Privilege Escalation Flaw

CVE-2021-47859 Overview

CVE-2021-47859 is an unquoted service path vulnerability in ActivIdentity 8.2, affecting the ac.sharedstore service. The service binary path under C:\Program Files\Common Files\ActivIdentity\ is registered without surrounding quotes. Local attackers with write access to a parent directory can plant a malicious executable that Windows loads when the service starts. Successful exploitation enables arbitrary code execution and privilege escalation to the security context of the service account. The weakness is tracked under CWE-428: Unquoted Search Path or Element.

Critical Impact
Local attackers can hijack the ac.sharedstore service path to execute arbitrary code and escalate privileges on Windows systems running ActivIdentity 8.2.

Affected Products

ActivIdentity 8.2
ac.sharedstore Windows service component
Systems with installations under C:\Program Files\Common Files\ActivIdentity\

Discovery Timeline

2026-01-21 - CVE-2021-47859 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2021-47859

Vulnerability Analysis

The vulnerability arises from how Windows resolves service binary paths containing spaces. When a service is registered with an unquoted ImagePath value, the Service Control Manager attempts to execute each whitespace-delimited prefix as a candidate executable. The ac.sharedstore service in ActivIdentity 8.2 is registered without quotes around its path, which contains the space in Program Files and Common Files. A local attacker who can write to C:\Program Files\ or C:\Program Files\Common Files\ can drop an executable such as Common.exe or ActivIdentity.exe that Windows will launch instead of the legitimate binary.

The service typically runs with elevated privileges, so code injected through this path executes under the same security context. This converts a low-privileged local user into a privileged code executor on the host.

Root Cause

The root cause is improper registration of the service ImagePath registry value without enclosing quotation marks. This is a classic [CWE-428] flaw where the installer fails to wrap binary paths containing whitespace in quotes.

Attack Vector

Exploitation requires local access and write permission on a parent directory in the unquoted path. The attacker places a malicious binary, then waits for a service restart or system reboot to trigger execution. No user interaction is needed beyond the initial file placement. Technical details are documented in the VulnCheck Advisory for ActivIdentity and Exploit-DB entry 49703.

Detection Methods for CVE-2021-47859

Indicators of Compromise

Unexpected executable files such as Program.exe, Common.exe, or ActivIdentity.exe placed directly under C:\Program Files\ or C:\Program Files\Common Files\.
Service start events where ac.sharedstore launches a binary from an unexpected path.
New child processes spawned by services.exe that do not match the legitimate ActivIdentity installation directory.

Detection Strategies

Query the registry for service ImagePath values containing spaces but no surrounding quotes using wmic service get name,pathname,startmode.
Monitor file creation events in C:\Program Files\ and C:\Program Files\Common Files\ from non-administrative users.
Alert on service binary modifications or replacements within ActivIdentity directories.

Monitoring Recommendations

Enable Windows Security event ID 4697 to track service installation and modification events.
Forward Sysmon process creation events (event ID 1) for binaries launched as children of services.exe.
Audit directory ACLs on C:\Program Files\ periodically to confirm only privileged identities can write.

How to Mitigate CVE-2021-47859

Immediate Actions Required

Inventory all hosts running ActivIdentity 8.2 and verify the ac.sharedstore service ImagePath registry value.
Manually quote the service path in the registry under HKLM\SYSTEM\CurrentControlSet\Services\ac.sharedstore if a vendor patch is unavailable.
Restrict write permissions on C:\Program Files\ and C:\Program Files\Common Files\ to administrators only.

Patch Information

No vendor patch URL is listed in the NVD data for CVE-2021-47859. Refer to HID Global for ActivIdentity product support and review the VulnCheck advisory for remediation guidance.

Workarounds

Edit the service ImagePath registry value to wrap the full binary path in double quotes, then restart the service.
Remove unnecessary local user write access to parent directories of the service binary.
Disable the ac.sharedstore service on hosts where ActivIdentity functionality is not required.

bash

# Configuration example: quote the service ImagePath using PowerShell
$svc = 'ac.sharedstore'
$key = "HKLM:\SYSTEM\CurrentControlSet\Services\$svc"
$path = (Get-ItemProperty -Path $key).ImagePath
if ($path -notmatch '^"') {
    $quoted = '"' + $path.Trim() + '"'
    Set-ItemProperty -Path $key -Name ImagePath -Value $quoted
    Restart-Service -Name $svc
}