Vulnerability record · CVE-2020-0638 · published 14 January 2020
CVE-2020-0638: Windows Update Notification Manager elevation of privilege via file handling
Microsoft · Windows 10 1709
The Update Notification Manager in Windows mishandles files, allowing an elevation of privilege. An attacker who already has code execution on a host can leverage this to gain higher privileges. It matters because it is listed in CISA KEV and has been associated with ransomware campaigns.
Description
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityActively exploited and linked to ransomware, with high CVSS impact, though it requires prior local access.
What it is
The Update Notification Manager in Windows mishandles files, allowing an elevation of privilege. An attacker who already has code execution on a host can leverage this to gain higher privileges. It matters because it is listed in CISA KEV and has been associated with ransomware campaigns.
Impact
An attacker gains elevated privileges on the victim system, typically SYSTEM-level access, enabling further compromise of the host.
Attack surface
The vulnerability is local (AV:L) and requires low privileges (PR:L) with no user interaction (UI:N). An attacker must first obtain execution on the target system before exploiting it.
Exploitation
CISA KEV lists this as actively exploited and known to be used in ransomware campaigns; EPSS 30-day probability is about 3.0% (86.9th percentile).
What to do
- Apply the Microsoft security update referenced in the vendor advisory.
- Restrict local interactive logon and code execution to trusted users.
- Monitor and limit use of the Update Notification Manager where feasible.
- Maintain endpoint detection and response coverage for privilege escalation behavior.
Detection
- Monitor for processes spawning from Update Notification Manager with unexpected elevated tokens.
- Alert on suspicious file operations or link following in Windows Update directories.
- Correlate local privilege escalation events with known ransomware precursor activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2020-0638 to the Known Exploited Vulnerabilities catalog on 23 May 2022 as "Microsoft Update Notification Manager Privilege Escalation Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 13 June 2022.
Affected products
9 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0638 | PatchVendor Advisory |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0638 | PatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0638 | US Government Resource |
Track CVE-2020-0638 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-0638), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
