What’s Vulnerable › Vulnerabilities

CVE-2020-16851: OneDrive for Windows Elevation of Privilege Vulnerability

• Severity: low (CVSS 3.6 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-09-11 · updated 2026-06-17
• Weakness: CWE-59

Description

<p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links. An attacker who successfully exploited this vulnerability could overwrite a targeted file with an elevated status.</p> <p>To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and delete a targeted file with an elevated status.</p> <p>The update addresses this vulnerability by correcting where the OneDrive updater performs file writes while running with elevation.</p>

Affected products

• Microsoft OneDrive for Windows: all versions
• Microsoft OneDrive for Windows: before publication — fixed in publication

How to fix

Upgrade to a fixed version: Microsoft OneDrive for Windows publication. Check the vendor advisory for mitigations.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16851
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16851

Get alerted when CVE-2020-16851 or the next vulnerability affects your stack