VX Search 13.5.28 contains an unquoted service path vulnerability in both VX Search Server and VX Search Enterprise services. When the services are restarted, an attacker who can place a malicious executable in an unquoted directory such as C:\Program Files\VX Search can trigger that executable under the LocalSystem account. This allows the attacker to execute arbitrary code with the highest local privilege level.

The vulnerability affects Vxsearch VX Search Server and VX Search Enterprise versions 13.5.28. These services run under the LocalSystem account on Windows machines where the installation path contains spaces and is not quoted.

The CVSS score of 8.5 indicates a high severity of local privilege escalation. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation has been reported. The attack vector is local; an attacker must already have access to the host and the ability to place files in the installation directory. Once the services restart, the attacker gains unrestricted local privileges.