What’s Vulnerable › Vulnerabilities

CVE-2020-1002

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-15 · updated 2026-06-17

Description

An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Defender Elevation of Privilege Vulnerability'.

Affected products

• Microsoft Forefront Endpoint Protection 2010: all versions
• Microsoft Security Essentials: all versions
• Microsoft System Center Endpoint Protection: 2012, 2012-r2
• Microsoft Windows Defender: all versions
• Microsoft Forefront Endpoint Protection: 2010
• Microsoft System Center: Endpoint Protection, 2012 R2 Endpoint Protection, 2012 Endpoint Protection
• Microsoft Security Essentials: all versions
• Microsoft Windows Defender on Windows 10 for 32-bit Systems: all versions
• Microsoft Windows Defender on Windows 10 for x64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1607 for 32-bit Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1607 for x64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1709 for 32-bit Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1709 for ARM64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1709 for x64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1803 for 32-bit Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1803 for ARM64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1803 for x64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1809 for 32-bit Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1809 for ARM64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1809 for x64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1903 for 32-bit Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1903 for ARM64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1903 for x64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1909 for 32-bit Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1909 for ARM64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1909 for x64-based Systems: all versions
• Microsoft Windows Defender on Windows 7 for 32-bit Systems: Service Pack 1
• Microsoft Windows Defender on Windows 7 for x64-based Systems: Service Pack 1
• Microsoft Windows Defender on Windows 8.1 for 32-bit systems: all versions
• Microsoft Windows Defender on Windows 8.1 for x64-based systems: all versions

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1002
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1002

Get alerted when CVE-2020-1002 or the next vulnerability affects your stack