{"id":"CVE-2020-0638","kind":"vulnerability","aliases":["CVE-2020-0638"],"related":[],"title":"Microsoft Update Notification Manager: Microsoft Update Notification Manager Privilege Escalation Vulnerability","description":"An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.","summary":"Microsoft Update Notification Manager on Windows has a local privilege escalation flaw. A user with limited access can gain higher system privileges on the machine.","severity":"high","cvss":7.8,"epss":0.0237,"exploited":true,"exploited_at":"2022-05-23T00:00:00+00:00","products":[{"name":"Microsoft Update Notification Manager","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","microsoft-update","ransomware","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the Microsoft update for CVE-2020-0638 per vendor instructions (CISA KEV required action).","status":"open","published_at":"2020-01-14T23:15:32+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:16:06+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:16:06Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft update for CVE-2020-0638 per vendor instructions (CISA KEV required action).","reach":"local","impact":"high","summary":"Microsoft Update Notification Manager on Windows has a local privilege escalation flaw. A user with limited access can gain higher system privileges on the machine.","category":"infrastructure","who_cares":["windows","microsoft-update"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the Windows machine","analyst_note":"Find the affected Windows builds and KB number in Microsoft's advisory for CVE-2020-0638 and confirm the patched version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000439,"input_tokens":2834,"output_tokens":312,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0638':14A,17A '-2020':13A,16A 'access':45B 'aka':84C 'attack':73C 'cve':12A,15A 'elev':55C,88C 'escal':10A,39B 'execut':79C 'exist':59C 'exploit':22B,69C 'files.to':68C 'first':75C 'flaw':40B 'gain':47B,78C 'handl':67C 'higher':48B 'infrastructur':23B 'limit':44B 'local':37B 'machin':53B 'manag':4A,8A,32B,66C,87C 'manager':21A 'microsoft':1A,5A,18A,25B,29B 'microsoft-upd':24B 'notif':3A,7A,31B,65C,86C 'notification':20A 'privileg':9A,38B,50B,57C,90C 'ransomwar':27B 'system':49B,83C 'updat':2A,6A,26B,30B,64C,85C 'update':19A 'user':42B 'victim':82C 'vulner':11A,58C,71C,91C 'way':62C 'window':28B,34B 'would':74C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-01-14T23:15:32+00:00","kev":{"dateAdded":"2022-05-23","dueDate":"2022-06-13","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-0638","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0638","severity":null,"published_at":"2022-05-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T12:39:24+00:00","note":null},{"source":"epss","external_id":"CVE-2020-0638","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0638","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-0638","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-0638","severity":null,"published_at":"2020-01-14T23:15:32+00:00","modified_at":"2026-08-12T05:17:27+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}