Read the docs
TI-2020-17854 Aliases CVE-2020-35152

Privilege escalation through unquoted service binary path on Cloudflare WARP for Windows

Priority LOW 34CWE-428Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-428.

Summary

Cloudflare WARP for Windows allows privilege escalation due to an unquoted service path. A malicious user or process running with non-administrative privileges can become an administrator by abusing the unquoted service path issue. Since version 1.2.2695.1, the vulnerability was fixed by adding quotes around the service's binary path. This issue affects Cloudflare WARP for Windows, versions prior to 1.2.2695.1.

Why it matters now

EPSS 0.00276 20th percentileScored 2026-11-07
Fix Fixed Cloudflare WARP for Windows (Cloudflare): 1.2.2695.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CloudflareCloudflare WARP for Windowsbefore 1.2.2695.11.2.2695.1Patch availableCNA
  • Cloudflare WARP for Windows VendorCloudflare Affected before 1.2.2695.1 Fixed in 1.2.2695.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cloudflare:warp:*:*:*:*:*:windows:*:*before 1.2.2695.1VulnerableCloudflare
  • cpe:2.3:a:cloudflare:warp:*:*:*:*:*:windows:*:* Versions before 1.2.2695.1 Vulnerable ·Cloudflare

Remediation

  • Fix · CNA Cloudflare WARP for Windows (Cloudflare) Fixed in 1.2.2695.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-35152

References

Advisory 1

  • TI-2022-04046 support_uri validation missing in WARP client for Windows CVSS 3.1HIGH 8.9
  • TI-2022-03068 Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command CVSS 3.1CRITICAL 9.8
  • TI-2023-01749 Remote access to warp-svc.exe in Cloudflare WARP CVSS 3.1HIGH 7.3
  • TI-2022-03240 Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command CVSS 3.1HIGH 8.8
  • TI-2023-02579 Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client CVSS 3.1HIGH 7.4
  • TI-2023-01335 Local Privilege Escalation Vulnerability in WARP's MSI Installer CVSS 3.1HIGH 7.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences