CVE-2020-0638

CVE-2020-0638 is a local elevation of privilege flaw in the way Microsoft's Update Notification Manager handles files (CWE-59, a link-following/race-condition class of bug), affecting Windows 10 versions 1709, 1803, 1809, 1903 and 1909, plus Windows Server 1803, 1903, 1909 and 2019. To trigger it, an attacker must first gain code execution on the victim system with limited privileges; no user interaction is required after that initial foothold. Successful exploitation allows the attacker to elevate privileges with high impact on confidentiality, integrity and availability, making it a useful step in ransomware and other intrusion chains to take full control of a host. Microsoft fixed the issue in its January 2020 Patch Tuesday security updates. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-05-23 with known ransomware use, confirming exploitation in the wild; no public proof-of-concept is known.

What to do: Apply Microsoft's January 2020 security updates (or any later cumulative update) to all affected Windows 10 and Windows Server systems, prioritizing user workstations and servers where an attacker with an existing foothold would matter; federal agencies must patch per CISA KEV/BOD 22-01 timelines. Inventory endpoints still running Windows 10 builds 1709–1909 and Windows Server 1803/1903/1909/2019 and verify the installed cumulative update level. Because exploitation requires prior code execution, pair patching with EDR and least-privilege controls to disrupt ransomware chains.