CVE-2020-0787 KEVRansomwarePublic exploit High · 7.8 EPSS 42.5%

Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability

Summary

The Windows Background Intelligent Transfer Service (BITS) component of Microsoft Windows improperly handles symbolic links, which leads to an elevation of privilege flaw. An attacker with local access to the system can exploit it to gain higher privileges, but this requires user interaction to succeed and does not require any prior authentication.

Official description · NVD

An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.

Breakdown

82.1 / 100

Exploited: Yes, in CISA KEV
Reports: 1
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Gain administrator or root rightsT1068 · Exploitation for Privilege EscalationSource data31 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterSource data95 general detection rules

First seen exploited 12 months after disclosure. Public exploit code (Metasploit) was available 2 days before disclosure.

Public exploit codeMetasploit10 Mar 20202 days before
Disclosed12 Mar 2020day 0
First seen exploitedVulnCheck KEV evidence25 Feb 2021+12 mo
Added to CISA KEVknown ransomware use; EU database agrees28 Jan 2022+23 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 1 cited passage 2

ExecutionTA0002

Command and Scripting Interpreter T1059

MITRE CTID mapping of the KEV entry · primary impact

CVE-2020-0787 is a privilege elevation vulnerability in the Windows Background Intelligent Transfer Service (BITS). An actor can exploit this vulnerability if it improperly handles symbolic links to execute arbitrary code with system-level privileges.

Privilege EscalationTA0004

Exploitation for Privilege Escalation T1068

MITRE CTID mapping of the KEV entry · how it is exploited

ion for Privilege Escalation The ProxyShell elevation of privilege on the Exchange PowerShell Backend (CVE-2021-34523), Windows Background Intelligent Transfer Service (BITS) improperly handling symbolic links (CVE-2020-0787), and abusing the CMSTPLUA COM interface have all been seen as methods of privilege escalation.

LockBit 2.0: How This RaaS Operates and How to Protect Against It unit42.paloaltonetworks.com Original ↗

Detection

0 rules for this CVE · 126 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-0787 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploitation for Privilege EscalationT106831 general rules

Exploiting CVE-2019-1388criticalstable
Audit CVE Eventcriticaltest
HackTool - SysmonEOP Executioncriticaltest
InstallerFileTakeOver LPE CVE-2021-41379 File Create Eventcriticaltest
Possible Coin Miner CPU Priority Paramcriticaltest
Potential CVE-2021-41379 Exploitation Attemptcriticaltest
Potential SystemNightmare Exploitation Attemptcriticaltest
Sudo Privilege Escalation CVE-2019-14287 - Builtincriticaltest

All 31 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report

1 reportUnit 42

Reports are matched by finding the exact id CVE-2020-0787 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Unit 42Undated

LockBit 2.0: How This RaaS Operates and How to Protect Against It

The ProxyShell elevation of privilege on the Exchange PowerShell Backend (CVE-2021-34523), Windows Background Intelligent Transfer Service (BITS) improperly handling symbolic links (CVE-2020-0787), and abusing the CMSTPLUA COM interface have all been seen as methods of privilege escalation.

Original (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

3 links, grouped by NVD tag (2 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 28 Jan 2022. Federal due date 28 Jul 2022. Known ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 28 Jan 2022. EUVD-2020-2274

Public exploitAdvisories link exploit code.

, 30 Oct 2026

42.5%Top 1.3%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 98.7%).

3.1

7.8High · 7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 2074 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9870 19.7/20

Threat reports1 report 3.9/10

Public exploit code1 NVD reference tagged Exploit; 2 PoC-in-GitHub repos; 1 Metasploit module 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 7.8 5.5/7

End-of-life productsupported or unknown 0.0

Total82.1

Record

Published: 12 Mar 2020
Modified: 12 Aug 2026
: CWE-59 Improper Link Resolution Before File AccessCWE-269 Improper Privilege Management
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

ExecutionTA0002

Privilege EscalationTA0004

Detection

Rules for this CVE

General rules for this CVE’s techniques

What security researchers reported

LockBit 2.0: How This RaaS Operates and How to Protect Against It

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

US Government Resource 1

Third Party Advisory 1

How attackers get in

What they do

techniques