KEV · Actively exploited
CVE-2020-0638
HIGH 7.8
KEV
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.
Attack vector : Local
No user interaction
Show raw CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
3.04%
above median
percentile 86.3%
CISA Known Exploited Vulnerability
- Added to KEV
- 2022-05-23
- Remediation deadline
- 2022-06-13
- Required action
- Apply updates per vendor instructions.
- Ransomware
- Yes, known ransomware campaign
OS versions that fix this CVE
This CVE is resolved by the following OS security releases. Update the OS to at least the listed version.
- Windows Server 2019 (Server Core installation) Fixed in —
- Windows Server 2019 Fixed in —
- Windows 10 1909 · 2019-09 Fixed in —
- Windows 10 1903 · 2019-03 Fixed in —
- Windows 10 1809 · 2018-09 Fixed in —
- Windows 10 1803 · 2018-03 Fixed in —
- Windows 10 1709 · 2017-09 Fixed in —