---
id: "CVE-2020-0638"
kind: "vulnerability"
aliases: ["CVE-2020-0638"]
title: "Microsoft Update Notification Manager: Microsoft Update Notification Manager Privilege Escalation Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.0237
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Update Notification Manager", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "microsoft-update", "ransomware", "windows"]
not_affected_if: ["unknown"]
published_at: "2020-01-14T23:15:32+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0638", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-0638", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0638", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Update Notification Manager: Microsoft Update Notification Manager Privilege Escalation Vulnerability

Microsoft Update Notification Manager on Windows has a local privilege escalation flaw. A user with limited access can gain higher system privileges on the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Update Notification Manager affected ? fixed ?

## Fix

Apply the Microsoft update for CVE-2020-0638 per vendor instructions (CISA KEV required action).

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0638
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-0638
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-0638

## From the sources

An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_