Read the docs
TI-2021-22426 Aliases CVE-2021-47810GHSA-9243-8h4w-g3wg

WibuKey Runtime 6.51 - 'WkSvW32.exe' Unquoted Service Path

Priority HIGH 72CWE-428Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-428.

Summary

WibuKey Runtime 6.51 contains an unquoted service path vulnerability in the WkSvW32.exe service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\PROGRAM FILES (X86)\WIBUKEY\SERVER\WkSvW32.exe' to inject malicious executables and escalate privileges.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0023 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WibuWibuKey Runtime6.51—No fix listedCNA
  • WibuKey Runtime VendorWibu Affected 6.51 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wibu:wibukey:6.51:*:*:*:*:*:*:*6.51VulnerableWibu
  • cpe:2.3:a:wibu:wibukey:6.51:*:*:*:*:*:*:* Versions 6.51 Vulnerable ·Wibu

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-47810
  2. 2026-10-03 Alias added: GHSA-9243-8h4w-g3wg

References

Exploit 1

Other 2

  • TI-2018-02959 An exploitable heap overflow vulnerability exists in the WkbProgramLow function of… CVSS 3.0CRITICAL 10.0
  • TI-2018-02958 An exploitable pool corruption vulnerability exists in the 0x8200E804 IOCTL handler… CVSS 3.0CRITICAL 9.3
  • TI-2024-30278 An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed… CVSS 3.1HIGH 8.8
  • TI-2018-02957 An exploitable kernel memory disclosure vulnerability exists in the 0x8200E804 IOCTL… CVSS 3.0MEDIUM 5.5
  • TI-2024-30279 An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed… CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences