CVE-2020-0986

HIGH KEV RANSOMWARE

Windows 10 - Elevation of Privilege via Memory Object Handling

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2020-0986 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns.

Description

An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1237, CVE-2020-1246, CVE-2020-1262, CVE-2020-1264, CVE-2020-1266, CVE-2020-1269, CVE-2020-1273, CVE-2020-1274, CVE-2020-1275, CVE-2020-1276, CVE-2020-1307, CVE-2020-1316.

References (3)

Core 3

Scores

CVSS v3 7.8
EPSS 0.1649
EPSS Percentile 95.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2021-11-03
VulnCheck KEV 2020-06-09
InTheWild.io 2020-06-09
ENISA EUVD EUVD-2020-2452
Ransomware Use Confirmed
CWE
CWE-787
Status published
Products (18)
microsoft/windows_10_1507 (2 CPE variants)
microsoft/windows_10_1607 (2 CPE variants)
microsoft/windows_10_1709 (3 CPE variants)
microsoft/windows_10_1803 (3 CPE variants)
microsoft/windows_10_1809 (3 CPE variants)
microsoft/windows_10_1903 (3 CPE variants)
microsoft/windows_10_1909 (3 CPE variants)
microsoft/windows_10_2004 (3 CPE variants)
microsoft/windows_8.1
microsoft/windows_rt_8.1
... and 8 more
Published Jun 09, 2020
KEV Added Nov 03, 2021
Tracked Since Feb 18, 2026