PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-20058 Netgate CVE debrief

CVE-2016-20058 is a high-severity vulnerability in Netgate AMITI Antivirus build 23.0.305. The vulnerability is caused by an unquoted service path in the AmitiAvSrv and AmitiAntivirusHealth services, which allows local attackers to escalate privileges. To exploit this vulnerability, an attacker can place a malicious executable in the unquoted service path and trigger a service restart or system reboot to execute code with LocalSystem privileges.

Vendor
Netgate
Product
NETGATE AMITI Antivirus
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-04
Original CVE updated
2026-07-21
Advisory published
2026-04-04
Advisory updated
2026-07-21

Who should care

System administrators and security teams responsible for Netgate AMITI Antivirus installations, particularly those using build 23.0.305, should prioritize patching this vulnerability to prevent potential privilege escalation attacks.

Technical summary

The vulnerability exists due to the unquoted service path in the AmitiAvSrv and AmitiAntivirusHealth services of Netgate AMITI Antivirus build 23.0.305. This allows local attackers to place a malicious executable in the service path, which can be executed with LocalSystem privileges when the service is restarted or the system is rebooted. The CVSS score for this vulnerability is 8.5, indicating a high severity level.

Defensive priority

High priority should be given to patching this vulnerability, as it allows for local privilege escalation. System administrators should ensure that the affected systems are updated to a patched version as soon as possible.

Recommended defensive actions

  • Apply the latest patch or update for Netgate AMITI Antivirus to address the unquoted service path vulnerability.
  • Conduct a thorough inventory of systems running Netgate AMITI Antivirus build 23.0.305 and prioritize patching.
  • Implement monitoring to detect potential exploitation attempts.
  • Consider compensating controls, such as restricting access to sensitive areas of the system.
  • Review system logs for suspicious activity related to the AmitiAvSrv and AmitiAntivirusHealth services.
  • Verify that all systems running Netgate AMITI Antivirus build 23.0.305 have been patched or mitigated.
  • Track and document the patching process for auditing and compliance purposes.

Evidence notes

The CVE record was published on 2026-04-04T14:16:18.390Z and was last modified on 2026-07-21T07:10:00.117Z. The NVD entry is currently Analyzed. The vulnerability details are based on the information provided by the CVE and NVD records.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-20058 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-20058

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-20058 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-20058

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.