CVE-2020-17087

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.054 · 93 %ileexploit · PoCEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 3 exploits · PoC

Likely / severe?

5.43% (93rd) EPSS

CVSS 7.2 · high

Is it mine?

77 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · fstec_bdu

added 2021-11-03remediate by 2022-05-03

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-27

Microsoft Windows Kernel Privilege Escalation Vulnerability

Windows Kernel Local Elevation of Privilege Vulnerability

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.07.2highAV:L/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 3.9 · impact 10

v2.07.2highAV:L/AC:L/Au:N/C:C/I:C/A:C/E:Hsecondary · CVSS-BT (t0sche)

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · NVD / NIST USexploitability 1.8 · impact 5.9

v3.17.8highAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:Csecondary · ENISA EU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · secure@microsoft.com USexploitability 1.8 · impact 5.9

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-131USprimaryCWE-119US

exploits (3)

Public proof-of-concept and weaponised exploit code.

raiden757/CVE-2020-17087raiden757/CVE-2020-17087PoC · poc_in_github
revengsh/CVE-2020-17087A CVE-2020-17087 PoC.PoC · poc_in_github
ykg88/OHTS_IE6052-CVE-2020-17087ykg88/OHTS_IE6052-CVE-2020-17087PoC · poc_in_github

affected products (77)

Products and version ranges known to be affected.

Microsoft Windows 10 Version 150710.0.0 → publicationenisa_euvdEU
Microsoft Windows 10 Version 160710.0.0 → publicationenisa_euvdEU
Microsoft Windows 10 Version 180310.0.0 → publicationenisa_euvdEU
Microsoft Windows 10 Version 180910.0.0 → publicationenisa_euvdEU
Microsoft Windows 10 Version 1903 for 32-bit Systems10.0.0 → publicationenisa_euvdEU
Microsoft Windows 10 Version 1903 for ARM64-based Systems10.0.0 → publicationenisa_euvdEU
Microsoft Windows 10 Version 1903 for x64-based Systems10.0.0 → publicationenisa_euvdEU
Microsoft Windows 10 Version 190910.0.0 → publicationenisa_euvdEU
Microsoft Windows 10 Version 200410.0.0 → publicationenisa_euvdEU
Microsoft Windows 10 Version 20H210.0.0 → publicationenisa_euvdEU
Microsoft Windows 76.1.0 → publicationenisa_euvdEU
Microsoft Windows 7 Service Pack 16.1.0 → publicationenisa_euvdEU
Microsoft Windows 8.16.3.0 → publicationenisa_euvdEU
Microsoft Windows Server 2008 R2 Service Pack 16.1.0 → publicationenisa_euvdEU
Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)6.0.0 → publicationenisa_euvdEU
Microsoft Windows Server 2008 Service Pack 26.0.0 → publicationenisa_euvdEU
Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)6.0.0 → publicationenisa_euvdEU
Microsoft Windows Server 20126.2.0 → publicationenisa_euvdEU
Microsoft Windows Server 2012 (Server Core installation)6.2.0 → publicationenisa_euvdEU
Microsoft Windows Server 2012 R26.3.0 → publicationenisa_euvdEU

showing 20 of 77

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu NVD CVE.org MITRE

published 2020-11-11modified 2026-06-17

related (350)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2015-0235US	high10.0	94.6% (100th)	Exploit	2015-01-28
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code…
CVE-2011-4862US	high10.0	95.1% (100th)	Exploit	2011-12-25
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU…
CVE-2023-36824US	high8.8	77.4% (100th)	—	2023-07-11
Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap o…
CVE-2005-3120US	critical9.8	23.3% (98th)	Exploit	2005-10-17
Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian chara…
CVE-2003-0899US	critical9.8	22.2% (98th)	Exploit	2003-11-03
Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '<' or '>' characters, which trigger t…

+345 more

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan