CVE-2020-0986KEV · OVERDUE

Microsoft Windows Kernel Privilege Escalation Vulnerability

High · published June 9, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 97.0th percentile for exploit probability.

1635
days past CISA
deadline
CVSS v3.1
7.8
EPSS
16%
Percentile
97.0
In the wild
Confirmed
What it is

🚨 Windows kernel's memory mishap could let a rogue app gain elevated privileges! This vulnerability makes it alarmingly easy to take control of your system. 🔥 Think of the kernel as a bouncer at an exclusive club, and this vulnerability as a secret entrance that let unauthorized guests slip in unnoticed. Once they're inside, they can access VIP areas, causing chaos! An attacker could exploit this flaw to run arbitrary code with system-level privileges, effectively hijacking the machine. This means they could install malware, steal sensitive data, or even disable security measures — absolutely devastating!

Put simply

Think of the kernel as a bouncer at an exclusive club, and this vulnerability as a secret entrance that let unauthorized guests slip in unnoticed. Once they're inside, they can access VIP areas, causing chaos! CVE-2020-0986 is an elevation of privilege vulnerability in the Windows kernel due to inadequate memory object handling, allowing unauthorized users to gain higher access rights than intended.

What to do

An attacker could exploit this flaw to run arbitrary code with system-level privileges, effectively hijacking the machine. This means they could install malware, steal sensitive data, or even disable security measures — absolutely devastating! To safeguard your systems, ensure you patch your Windows installations to the latest version as soon as possible. Regularly update your security protocols and conduct vulnerability assessments to identify and mitigate risks promptly. You've got this! Stay proactive, and with these steps, you'll keep your system secure like a pro. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.16405 · 97.0th percentile
Published
2020-06-09T19:43Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 09 JUN 19:43Z
    An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege…
    cvelistv5