CVE-2020-0787: Windows BITS symbolic link handling privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityConfirmed exploited-in-the-wild elevation of privilege with public exploit code, KEV listing and high EPSS, though it requires a local foothold and user interaction.

What it is

Windows Background Intelligent Transfer Service (BITS) mishandles symbolic links, allowing a local attacker to escalate privileges. The flaw is a link-following issue (CWE-59) that affects a broad set of Windows client and server versions. It matters because it is a confirmed exploited-in-the-wild elevation of privilege bug with a high EPSS score.

Impact

An attacker who gains a foothold on a host can elevate from a low-privileged account to SYSTEM or administrative rights, enabling full control of the machine. This can be chained with other malware or used to deploy ransomware.

Attack surface

The vector is local (AV:L) with no privileges required (PR:N) but user interaction is required (UI:R), meaning the attacker must already have code execution or a session on the target and induce a user action. It is not remotely reachable without an existing local foothold.

Exploitation

CVE-2020-0787 is listed in CISA KEV with a due date of 2022-07-28 and known ransomware campaign use, and public exploit code exists per Packet Storm references. EPSS 30-day probability is 0.425 (98.6th percentile), indicating high likelihood of exploitation.

What to do

• Apply the Microsoft security update for CVE-2020-0787 on all affected Windows versions.
• Prioritize patching internet-facing and high-value endpoints, and any system where BITS is enabled.
• Restrict local interactive logon and code execution to trusted users to reduce the foothold needed for exploitation.
• Monitor and, where feasible, disable or restrict BITS if not required by business processes.
• Include this CVE in vulnerability management scans and verify remediation across the full affected product list.

Detection

• Monitor for unusual BITS job creation or modification events, especially involving symbolic links or unexpected file paths.
• Alert on processes spawning from BITS or creating symlinks in user-writable directories that target privileged locations.
• Correlate local privilege escalation attempts with subsequent SYSTEM-level process creation or service installation.
• Review Windows event logs for BITS-related errors or anomalous job activity around times of suspicious user sessions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.