CVE-2020-0683: Windows Installer MSI symbolic link handling privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a locally exploitable elevation of privilege flaw with confirmed in-the-wild exploitation per CISA KEV and a high EPSS percentile, though it requires an existing foothold.

What it is

Windows Installer mishandles symbolic links while processing MSI packages, allowing a local user to follow a crafted link and gain elevated privileges. The flaw affects a broad set of Windows client and server releases, and Microsoft patched it in February 2020. Because it is a local privilege escalation in a core component, it is useful to attackers who already have a foothold.

Impact

An attacker who can run code on the host can escalate from a low-privileged account to SYSTEM or administrative rights. That access enables credential theft, persistence and further lateral movement.

Attack surface

The vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker must already have code execution or an interactive session on the target. No network exposure or victim action is needed beyond running the crafted MSI or triggering the link processing.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild, and EPSS shows a 30-day probability of about 7.7 percent (94th percentile). No ransomware campaign use is documented in the record.

What to do

• Apply the Microsoft security update for CVE-2020-0683 on all affected Windows client and server versions, prioritizing internet-facing and multi-user systems.
• Restrict local administrative rights and enforce least privilege so a compromised low-privileged account cannot easily reach the vulnerable MSI processing path.
• Harden MSI handling where feasible, for example by controlling who can install packages and monitoring for unusual msiexec.exe invocations.
• Track CISA KEV remediation deadlines and verify patching through vulnerability scanning or configuration baselines.

Detection

• Monitor for msiexec.exe processes that create or follow symbolic links in user-writable or temporary directories.
• Alert on unexpected elevation of low-privileged processes to SYSTEM or administrative tokens shortly after MSI installation activity.
• Audit Windows Installer and process creation logs for msiexec.exe spawned from unusual parent processes or user profile paths.
• Correlate local privilege escalation events with known post-exploitation behavior such as credential dumping or new service creation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.