{"id":"CVE-2020-0787","published":"2020-03-12T16:15:15Z","modified":"2026-08-12T05:17:28Z","title":"Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.","provenance":"source","from":"NVD"},"summary":{"text":"The Windows Background Intelligent Transfer Service (BITS) component of Microsoft Windows improperly handles symbolic links, which leads to an elevation of privilege flaw. An attacker with local access to the system can exploit it to gain higher privileges, but this requires user interaction to succeed and does not require any prior authentication.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:26Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.42524,"percentile":0.98702,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-01-28","dueDate":"2022-07-28","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0787","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-02-25","exploitedFirstSeen":"2021-02-25","ransomware":true,"evidence":[{"url":"https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html","date":"2021-02-25"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-209a","date":"2021-08-20"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-01-28"},{"url":"https://www.tenable.com/blog/contileaks-chats-reveal-over-30-vulnerabilities-used-by-conti-ransomware-affiliates","date":"2022-03-24"},{"url":"https://static.tenable.com/marketing/whitepapers/Whitepaper-Ransomware_Ecosystem.pdf","date":"2022-06-22"},{"url":"https://www.securin.io/articles/all-about-conti-ransomware/","date":"2022-06-29"},{"url":"https://asec.ahnlab.com/en/56236/","date":"2023-08-22"},{"url":"https://www.orangecyberdefense.com/global/blog/research/ivanti-deja-vu","date":"2024-03-01"},{"url":"https://www.cisa.gov/sites/default/files/2024-08/aa24-242a-stopransomware-ransomhub-ransomware_0.pdf","date":"2024-08-29"},{"url":"https://www.cyfirma.com/research/apt-profile-kimsuky/","date":"2024-09-12"}],"evidenceTotal":15,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-59","name":"Improper Link Resolution Before File Access"},{"id":"CWE-269","name":"Improper Privilege Management"}],"references":[{"url":"http://packetstormsecurity.com/files/158056/Background-Intelligent-Transfer-Service-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0787","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/158056/Background-Intelligent-Transfer-Service-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0787","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0787","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev","dataset-annotation"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Privilege Management; TRAM2 annotated sentence label","mappingType":"exploitation_technique","evidence":[{"reportId":"SRC-3bd87bcc3ec7ea8da0e5","quote":"ion for Privilege Escalation\nThe ProxyShell elevation of privilege on the Exchange PowerShell Backend (CVE-2021-34523), Windows Background Intelligent Transfer Service (BITS) improperly handling symbolic links (CVE-2020-0787), and abusing the CMSTPLUA COM interface have all been seen as methods of privilege escalation.","start":9621,"end":9941}],"comment":"CVE-2020-0787 is a privilege elevation vulnerability in the Windows Background Intelligent Transfer Service (BITS). An actor can exploit this vulnerability if it improperly handles symbolic links to execute arbitrary code with system-level privileges.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Privilege Management","mappingType":"primary_impact","evidence":[],"comment":"CVE-2020-0787 is a privilege elevation vulnerability in the Windows Background Intelligent Transfer Service (BITS). An actor can exploit this vulnerability if it improperly handles symbolic links to execute arbitrary code with system-level privileges.","confidence":"high"}],"reports":[{"id":"SRC-3bd87bcc3ec7ea8da0e5","title":"LockBit 2.0: How This RaaS Operates and How to Protect Against It","publisher":"unit42.paloaltonetworks.com","url":"https://unit42.paloaltonetworks.com/lockbit-2-ransomware/","date":null,"mentions":[{"quote":"The ProxyShell elevation of privilege on the Exchange PowerShell Backend (CVE-2021-34523), Windows Background Intelligent Transfer Service (BITS) improperly handling symbolic links (CVE-2020-0787), and abusing the CMSTPLUA COM interface have all been seen as methods of privilege escalation.","start":9650,"end":9941}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-2274","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-2274","exploited":true,"exploitedSince":"2022-01-28","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2020-06-16","earliestUrl":"https://github.com/cbwang505/CVE-2020-0787-EXP-ALL-WINDOWS-VERSION","repos":[{"name":"cbwang505/CVE-2020-0787-EXP-ALL-WINDOWS-VERSION","url":"https://github.com/cbwang505/CVE-2020-0787-EXP-ALL-WINDOWS-VERSION","stars":721,"created":"2020-06-16"},{"name":"yanghaoi/CVE-2020-0787","url":"https://github.com/yanghaoi/CVE-2020-0787","stars":34,"created":"2021-11-16"}]},"metasploit":[{"name":"Background Intelligent Transfer Service Arbitrary File Move Privilege Elevation Vulnerability","module":"exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move","type":"exploit","disclosureDate":"2020-03-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.rb"}],"first":{"date":"2020-03-10","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/158056/Background-Intelligent-Transfer-Service-Privilege-Escalation.html"],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2020-03-10","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2020-06-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.rb","provenance":"source"},{"date":"2020-03-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-0787","provenance":"source"},{"date":"2021-02-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html","provenance":"source"},{"date":"2022-01-28","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-01-28","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-2274","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":687},"priority":{"score":82.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2072 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.74,"detail":"percentile 0.9870"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-59"}}