Endpoint and server security
CVE-2023-7043: Unquoted path privilege vulnerability in ESET products for Windows
Unquoted service path in ESET products allows to drop a prepared program to a specific location and run on boot with the NT AUTHORITY\NetworkService permissions.
Published
ExploitedNot in CISA KEV
Ransomware useNot reportedPer CISA
SeverityLOWCVSS 3.1 3.3
EPSS0.28%Chance of exploitation in 30 days
Public exploitNot tracked
FixSee advisory
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| ESET Endpoint Security 10.1.2046.x to 10.1.2063.x | Upgrade past 10.1.2063.x; see the advisory |
| ESET Endpoint Antivirus 10.1.2046.x to 10.1.2063.x | Upgrade past 10.1.2063.x; see the advisory |
| ESET NOD32 Antivirus 16.1.14.0 to 16.2.15.0 | Upgrade past 16.2.15.0; see the advisory |
| ESET Internet Security 16.1.14.0 to 16.2.15.0 | Upgrade past 16.2.15.0; see the advisory |
| ESET Smart Security Premium 16.1.14.0 to 16.2.15.0 | Upgrade past 16.2.15.0; see the advisory |
| ESET Mail Security for Microsoft Exchange Server 10.1 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Unquoted service path in ESET products allows to
drop a prepared program to a specific location and run on boot with the
NT AUTHORITY\NetworkService permissions.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.