May 23, 2022 · Applied Cybernetics Group
CVE-2020-0638 — Microsoft Update Notification Manager
known ransomware use
Microsoft Update Notification Manager Privilege Escalation Vulnerability
- Added to KEV
2022-05-23- Federal due date
2022-06-13- Vendor
- Microsoft
- Product
- Update Notification Manager
- EPSS
- 86.9th percentile (score 0.030, as of
2026-09-16) - NVD CVSS v3.1
- 7.8 (HIGH)
- Ransomware use
- Known
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2020-0638
CISA short description
Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.
Required action
Apply updates per vendor instructions.
NVD description
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.