CVE-2020-0638

This bug is like a “privilege boost” flaw: if someone has already gotten some code to run on your Windows machine, they may be able to use this weakness to gain higher control. That can make a ransomware attack more damaging because the attacker can do more once they’re inside.

This matters if you run or manage Windows 10, Windows Server, or Windows Server 2019 computers.

The vulnerability is local and requires the attacker to already have code running on the victim system; it is not about tricking users with clicks or opening a file by itself. The key question is whether an attacker could already execute code on your machine (for example through malware, stolen credentials, or another compromise).

RED — attackers are known to have used this weakness in ransomware campaigns, and CISA added it to its KEV list. Because it enables privilege escalation after code execution, any existing compromise can become significantly worse.

Act now to ensure all affected Windows systems have the Microsoft-recommended updates for CVE-2020-0638 installed, and verify the patch actually applied.

1. Confirm scope (which devices are affected)

   • Identify all endpoints running Windows 10, Windows Server, and Windows Server 2019 in your business environment.

2. Check patch status for CVE-2020-0638

   • On each machine, review installed Windows Update/security updates (via your patch management system and/or the local Windows Update history).
   • Specifically verify that the security update(s) recommended by Microsoft for CVE-2020-0638 are present.
   • If your organization tracks “CVE-to-KB” mappings, use the Microsoft advisory associated with CVE-2020-0638 to map the CVE to the exact KB(s) you must see installed.

3. Patch (apply the vendor remediation)

   • Install the latest available Windows security updates per Microsoft’s guidance for CVE-2020-0638.
   • Follow your standard change-control process, but prioritize servers and any machines with higher exposure (remote access, admin access, or internet-facing services).

4. Reboot and validate

   • Reboot if updates require it.
   • After reboot, confirm Windows reports the relevant security update(s) as installed.

5. Temporary risk reduction if patching is delayed

   • Reduce the chance of “initial code execution” on endpoints by tightening remote access, least-privilege admin practices, and application controls.
   • Segment networks so that a compromised host has fewer paths to other critical systems.

6. What to monitor after patching

   • Look for signs of compromise (unexpected privilege changes, suspicious process activity consistent with malware execution, and unusual administrative actions).
   • Ensure your endpoint protection and audit logging are enabled so you can investigate any incidents quickly.

CVE-2020-0638 is an elevation-of-privilege issue (CWE-59) in how Windows’ Update Notification Manager handles files. The attack model is local: an attacker must first achieve code execution on the victim system, then can use the flaw to elevate privileges, with no user interaction required. This increases the impact of an initial foothold, because the attacker can gain more control after they’re already running code.

Real-world relevance: the issue is listed in CISA KEV and was added on 2022-05-23 with a remediation due date of 2022-06-13; KEV notes usage in ransomware campaigns. That makes it an actively relevant patch target for organizations.

Exploit maturity: no public exploit code is listed in the provided findings, but KEV confirmation indicates operational use in ransomware. EPSS is a prediction and is not used to weaken the urgency because KEV/news confirmation is treated as decisive per the instructions.