What’s Vulnerable › Vulnerabilities

CVE-2020-1170

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-06-09 · updated 2026-06-17
• Weakness: CWE-732

Description

An elevation of privilege vulnerability exists in Windows Defender that leads arbitrary file deletion on the system.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Windows Defender Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1163.

Affected products

• Microsoft Forefront Endpoint Protection 2010: all versions
• Microsoft Security Essentials: all versions
• Microsoft System Center Endpoint Protection: 2012, 2012-r2
• Microsoft Windows Defender: all versions
• Microsoft Forefront Endpoint Protection: 2010
• Microsoft System Center: Endpoint Protection, 2012 R2 Endpoint Protection, 2012 Endpoint Protection
• Microsoft Security Essentials: all versions
• Microsoft Windows Defender on Windows 10 for 32-bit Systems: all versions
• Microsoft Windows Defender on Windows 10 for x64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1607 for 32-bit Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1607 for x64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1709 for 32-bit Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1709 for ARM64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1709 for x64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1803 for 32-bit Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1803 for ARM64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1803 for x64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1809 for 32-bit Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1809 for ARM64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1809 for x64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1903 for 32-bit Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1903 for ARM64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1903 for x64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1909 for 32-bit Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1909 for ARM64-based Systems: all versions
• Microsoft Windows Defender on Windows 10 Version 1909 for x64-based Systems: all versions
• Microsoft Windows Defender on Windows 7 for 32-bit Systems: Service Pack 1
• Microsoft Windows Defender on Windows 7 for x64-based Systems: Service Pack 1
• Microsoft Windows Defender on Windows 8.1 for 32-bit systems: all versions
• Microsoft Windows Defender on Windows 8.1 for x64-based systems: all versions

References

• http://packetstormsecurity.com/files/160919/Cloud-Filter-Arbitrary-File-Creation-Privilege-Escalation.html
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1170
• http://packetstormsecurity.com/files/160919/Cloud-Filter-Arbitrary-File-Creation-Privilege-Escalation.html
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1170

Get alerted when CVE-2020-1170 or the next vulnerability affects your stack