CVE-2020-37160 SprintWork 2.3.1 - Local Privilege Escalation
Local attackers can exploit insecure permissions to create an administrative user and gain full system access on Windows systems running SprintWork.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-37160?
CVE-2020-37160 is a high-severity vulnerability in Veridium SprintWork, published on 6 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local unprivileged users can exploit missing executable files and weak service configurations to create a new administrative user and gain complete system access.
Weakness: CWE-276
Which versions are affected by CVE-2020-37160?
How do I fix CVE-2020-37160?
No fix has been published for CVE-2020-37160 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-37160 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-37160 exists.
Sources
Also known as GHSA-788g-f8cx-72jv.