CVE-2020-1027: Windows Kernel memory handling elevation of privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityConfirmed in-the-wild exploitation via KEV plus a public exploit and a broad affected Windows footprint, though it requires local access and is not remotely reachable.

What it is

The Windows Kernel mishandles objects in memory, an out-of-bounds write (CWE-787) that lets a local user escalate privileges. It affects a broad set of Windows client and server releases, so unpatched hosts carry a real risk of full system compromise from an already-logged-in account.

Impact

An attacker who can run code on the host gains elevated privileges, up to SYSTEM, allowing them to disable security controls, persist, and move laterally.

Attack surface

Reached locally: the CVSS vector is AV:L with PR:L and UI:N, so the attacker needs existing low-privileged access to the machine but no user interaction. It is not remotely exploitable on its own.

Exploitation

CISA added it to KEV on 2022-05-23 with a 2022-06-13 remediation due date, and a public exploit reference exists, so exploitation in the wild is confirmed. EPSS 30-day probability is about 4.5 percent (91st percentile).

What to do

• Apply the Microsoft security update for CVE-2020-1027 on all affected Windows client and server versions; this is the primary fix.
• Prioritize internet-facing and multi-user hosts, and any system where standard users can run code, for immediate patching.
• Enforce least privilege so users do not hold local admin rights, reducing the value of the escalation.
• Track KEV due dates and verify remediation through patch or vulnerability management reporting.

Detection

• Monitor for unexpected process token elevation or processes running as SYSTEM that were spawned from low-privileged user contexts.
• Alert on exploitation artifacts tied to the public kernel exploit reference, such as unusual kernel object manipulation or crash patterns in kernel memory handling.
• Audit hosts still missing the April 2020 Windows cumulative updates against the affected product list.
• Correlate local privilege escalation events with subsequent credential access, persistence, or lateral movement activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.