CVE-2016-20033

Wowza Streaming Engine 4.5.0 Local Privilege Escalation via nssm_x64.exe

High8.5Public exploitEPSS 0.22%

Published: 15 Mar 2026
Updated: 16 Mar 2026
Reserved: 15 Mar 2026
Assigned by: VulnCheck

Description

Wowza Streaming Engine 4.5.0 contains a local privilege escalation vulnerability that allows authenticated users to escalate privileges by replacing executable files due to improper file permissions granting full access to the Everyone group. Attackers can replace the nssm_x64.exe binary in the manager and engine service directories with malicious executables to execute code with LocalSystem privileges when services restart.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

ExploitDB-40132 (opens in a new tab)exploit

Timeline

2026
15 Mar 2026
15 Mar 2026
ID reserved
By VulnCheck
15 Mar 2026
15 Mar 2026
Published
16 Mar 20261 day later
16 Mar 2026· 1 day later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2016-20033, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.5	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed	4.0	High8.5	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.22% · top 88% of all CVEs (8 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.5.

Weakness

CWE-639: Authorization Bypass Through User-Controlled Key (opens in a new tab)All about CWE-639 and its CVEs

Affected products

Wowza Media Systems, LLC. · Wowza Streaming Engine
- affected 4.5.0

References (3)

ExploitDB-40132 (opens in a new tab)exploit
Vulnerability Advisory (opens in a new tab)vendor-advisory
VulnCheck Advisory: Wowza Streaming Engine 4.5.0 Local Privilege Escalation via nssm_x64.exe (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2016-20033](https://cveledger.app/badge/CVE-2016-20033.svg)](https://cveledger.app/cve/CVE-2016-20033)

Record last updated 16 Mar 2026, 14:30 UTC.