Microsoft Windows Kernel Privilege‑Escalation Vulnerability (CVE‑2020‑17087)
What It Is
A kernel‑level flaw in Microsoft Windows allows a low‑privileged process to gain SYSTEM rights. The vulnerability is classified as “unspecified” in the public advisory but is known to enable privilege escalation without requiring authentication.
Exploitability
Public proof‑of‑concept code and multiple threat‑actor reports confirm active exploitation in the wild. The CVSS v3.1 base score is 7.8 (High). Microsoft released a security update in March 2020 that addresses the issue.
Affected Products
All supported Windows client and server releases that share the vulnerable kernel component, including Windows 10 (1903 and later) and Windows Server 2016/2019.
Why It Matters for Compliance & Audit Readiness
- Access‑Control Assurance: Unchecked privilege escalation undermines the principle of least privilege, a core control in NIST CSF PR.AC‑1 and ISO 27001 A.9.2.
- Continuous Control Monitoring: Detecting and evidencing patch deployment demonstrates due‑diligence for vendor‑management controls (SOC 2 CC6.1, PCI‑DSS 6.2).
- Defensible Audit Trail: Documenting remediation actions and monitoring for exploit attempts provides verifiable proof for auditors that the organization maintains a trusted security posture.
Recommended Actions
- Verify that the March 2020 Windows security update (KB4528760) is fully deployed across all endpoints.
- Run a vulnerability scan or use Microsoft’s Safety Scanner to confirm remediation.
- Update your privileged‑access management (PAM) policies to enforce least‑privilege and monitor for anomalous elevation events.
- Capture patch‑deployment logs and SIEM alerts as evidence for audit reviews.
- Incorporate the vulnerability into your continuous control‑monitoring dashboard to track remediation status.
Source: CISA KEV – CVE‑2020‑17087