KEV · Actively exploited
CVE-2020-0787
HIGH 7.8
KEV
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.
Attack vector : Local
No privileges required
Show raw CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
42.52%
moderate exploit risk
percentile 98.6%
CISA Known Exploited Vulnerability
- Added to KEV
- 2022-01-28
- Remediation deadline
- 2022-07-28
- Required action
- Apply updates per vendor instructions.
- Ransomware
- Yes, known ransomware campaign
OS versions that fix this CVE
This CVE is resolved by the following OS security releases. Update the OS to at least the listed version.
- Windows Server 2019 (Server Core installation) Fixed in —
- Windows Server 2019 Fixed in —
- Windows Server 2016 (Server Core installation) Fixed in —
- Windows Server 2016 Fixed in —
- Windows 10 1909 · 2019-09 Fixed in —
- Windows 10 1903 · 2019-03 Fixed in —
- Windows 10 1809 · 2018-09 Fixed in —
- Windows 10 1803 · 2018-03 Fixed in —
- Windows 10 1709 · 2017-09 Fixed in —
- Windows 10 1607 · 2016-07 Fixed in —