CVE
CVE-2020-1013
- First Reported
- Sep 8, 2026
- Latest Reported
- Sep 8, 2026
CVE Enrichment
- CVSS
- 7.5 HIGH
- EPSS
- 6.41%
- EPSS Percentile
- 93.52%
- CISA KEV
- Not listed
Description
<p>An elevation of privilege vulnerability exists when Microsoft Windows processes group policy updates. An attacker who successfully exploited this vulnerability could potentially escalate permissions or perform additional privileged actions on the target machine.</p> <p>To exploit this vulnerability, an attacker would need to launch a man-in-the-middle (MiTM) attack against the traffic passing between a domain controller and the target machine. An attacker could then create a group policy to grant administrator rights to a standard user.</p> <p>The security update addresses the vulnerability by enforcing Kerberos authentication for certain calls over LDAP.</p>
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- secure@microsoft.com
- Published
- 12-Sep-2020 00:15
- Last Modified
- 17-Jun-2026 10:00
- EPSS Date
- 2026-10-11
CVSS Vector
CVSS:3.1 AV:A /
AC:H /
PR:N /
UI:N /
S:U /
C:H /
I:H /
A:H
Affected Products / Versions
- microsoft / windows_10
Version / affected range: -
cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* - microsoft / windows_10
Version / affected range: 1607
cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* - microsoft / windows_10
Version / affected range: 1709
cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* - microsoft / windows_10
Version / affected range: 1803
cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:* - microsoft / windows_10
Version / affected range: 1809
cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* - microsoft / windows_10
Version / affected range: 1903
cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:* - microsoft / windows_10
Version / affected range: 1909
cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:* - microsoft / windows_10
Version / affected range: 2004
cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:* - microsoft / windows_7
Version / affected range: -
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* - microsoft / windows_8.1
Version / affected range: -
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* - microsoft / windows_rt_8.1
Version / affected range: -
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* - microsoft / windows_server_2008
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* - microsoft / windows_server_2008
Version / affected range: r2
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* - microsoft / windows_server_2012
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* - microsoft / windows_server_2012
Version / affected range: r2
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* - microsoft / windows_server_2016
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* - microsoft / windows_server_2016
Version / affected range: 1903
cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:* - microsoft / windows_server_2016
Version / affected range: 1909
cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:* - microsoft / windows_server_2016
Version / affected range: 2004
cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:* - microsoft / windows_server_2019
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
References
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
CVE (71)
Malware (4)
Threat Actors (1)
Vendors (22)
Products (18)
Tools (7)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.