ZeroDay Findings
Sign inSign up

Findings

CVE-2020-0638

Microsoft Update Notification Manager Privilege Escalation Vulnerability

Published Jan 14, 2020 · updated Aug 11, 2026 · microsoft windows 10 1709

An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 14, 2020 · Catalog

    Detected

    An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.

  2. May 23, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 13, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Aug 11, 2026 · Catalog

    Updated

    An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.

Required action

Apply updates per vendor instructions.

CISA due date Jun 13, 2022

Affected

  • cpe microsoft/windows 10 1709version unspecified
  • cpe microsoft/windows 10 1803version unspecified
  • cpe microsoft/windows 10 1809version unspecified
  • cpe microsoft/windows 10 1903version unspecified
  • vendor Microsoft Update Notification Managerversion unspecified

Sources

  • CISA KEVCVE-2020-0638

    Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.

    cisa.gov
  • CVE.orgCVE-2020-0638

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-0638

    30-day exploitation probability 2.4%

    first.org
  • NIST NVDCVE-2020-0638

    An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.

    nvd.nist.gov

References