7.8 High Exploited

CVE-2020-0986 Microsoft Windows Kernel Privilege Escalation Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Weakness CWE-787

Description

An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1237, CVE-2020-1246, CVE-2020-1262, CVE-2020-1264, CVE-2020-1266, CVE-2020-1269, CVE-2020-1273, CVE-2020-1274, CVE-2020-1275, CVE-2020-1276, CVE-2020-1307, CVE-2020-1316.

Affected products and versions

Product	Affected versions	Fixed in
Windows	Versions not published
Windows Server	2019	No fix stated
Windows Server	2016	No fix stated
Windows Server	2012	No fix stated
Windows 10 Version 1909 for 32-bit Systems	Versions not published
Windows 10 Version 1909 for x64-based Systems	Versions not published
Windows 10 Version 1909 for ARM64-based Systems	Versions not published
Windows Server, version 1909 (Server Core installation)	Versions not published
Windows 10 Version 1903 for 32-bit Systems	Versions not published

Show the 7 other branches

Product	Affected versions	Fixed in
Windows 10 Version 1903 for x64-based Systems	Versions not published
Windows 10 Version 1903 for ARM64-based Systems	Versions not published
Windows Server, version 1903 (Server Core installation)	Versions not published
Windows 10 Version 2004 for 32-bit Systems	Versions not published
Windows Server, version 2004 (Server Core installation)	Versions not published
Windows 10 Version 2004 for ARM64-based Systems	Versions not published
Windows 10 Version 2004 for x64-based Systems	Versions not published

References

portal.msrc.microsoft.com portal.msrc.microsoft.com
packetstormsecurity.com packetstormsecurity.com

Timeline

Published June 9, 2020
Added to the KEV catalogue November 3, 2021
Last modified October 21, 2025

The 829 CVEs of Windows →

CVE-2025-59033 The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy 7.4 High CVE-2022-50238 The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended… 7.4 High CVE-2025-9491 Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability 7.0 High CVE-2022-40733 An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version… 5.0 Medium

Track this CVE