CVE-2020-17087KEV · OVERDUE

Windows Kernel Local Elevation of Privilege Vulnerability

High · published November 11, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 92.7th percentile for exploit probability.

1635
days past CISA
deadline
CVSS v3.1
7.8
EPSS
5%
Percentile
92.7
In the wild
Confirmed
What it is

🚨 A local elevation of privilege vulnerability in the Windows Kernel is an open door to serious trouble! ⚡ Think of it like a secret ladder hidden behind a bookshelf in a library, allowing anyone to reach the restricted sections and access the rarest books without permission. This vulnerability lets attackers climb right up to system-level access without breaking a sweat! An attacker with this exploit could gain complete control over the system, allowing them to install malware, access sensitive information, or even take over other accounts. This means the attacker could run amok, wreaking havoc on your system like a mischievous ghost in a once-peaceful library!

Put simply

Think of it like a secret ladder hidden behind a bookshelf in a library, allowing anyone to reach the restricted sections and access the rarest books without permission. This vulnerability lets attackers climb right up to system-level access without breaking a sweat! CVE-2020-17087 is a Windows Kernel vulnerability that allows a local user to elevate their privileges by exploiting a flaw in how the kernel handles specific operations. This flaw could enable a user to execute arbitrary code with elevated permissions.

What to do

An attacker with this exploit could gain complete control over the system, allowing them to install malware, access sensitive information, or even take over other accounts. This means the attacker could run amok, wreaking havoc on your system like a mischievous ghost in a once-peaceful library! To protect your system, patch to the latest version of Windows that addresses this vulnerability. Regularly check for and apply updates from Microsoft, and consider implementing stricter user permissions to limit exposure. Don't forget to educate users about the risks of running unverified applications! You've got this! Just follow these steps, and you'll boost your defenses against this sneaky vulnerability in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.05431 · 92.7th percentile
Published
2020-11-11T06:48Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 11 NOV 06:48Z
    Windows Kernel Local Elevation of Privilege Vulnerability
    cvelistv5