How to Fix CVE-2020-0683: Elevation of Privilege in Windows

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

⚠️ Patch immediately. CVE-2020-0683 is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03). Federal agencies had until 2022-05-03 to remediate.

What is CVE-2020-0683?

CVE-2020-0683 is a local elevation-of-privilege flaw in the Windows Installer service (the msiserver component behind msiexec.exe and .msi packages). Microsoft's own description is precise: "An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links." Microsoft titled it the "Windows Installer Elevation of Privilege Vulnerability." It is a distinct issue from CVE-2020-0686, which Microsoft patched the same month.

The root cause is classified as CWE-59, improper link resolution before file access, commonly called "link following." Windows Installer runs many of its file operations as NT AUTHORITY\SYSTEM during install, repair, and rollback. When the installer follows a symbolic link (or NTFS junction / mount point) that a low-privileged user planted, it can be tricked into writing, moving, or deleting a file the user could never touch directly. By controlling the link target, an attacker redirects a SYSTEM-level file operation to a protected location and turns it into arbitrary file creation or overwrite. the classic stepping stone from a normal user account to full SYSTEM.

This is not a remote bug. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.8 (High): the attacker must already have a local foothold and low-privilege credentials, but needs no user interaction and the attack complexity is low. There is no network vector and no firewall rule that stops it. CISA confirmed in-the-wild exploitation by adding it to the Known Exploited Vulnerabilities catalog on 2021-11-03, so on any unpatched, multi-user, or shared host you should treat a SYSTEM compromise from any logged-in user as realistic.

Identify

You are affected if you run any Windows or Windows Server build in the Affected row above and have not installed a February 2020 or later cumulative/security update. Confirm your build and last-installed update:

# Current OS build
[System.Environment]::OSVersion.Version
(Get-CimInstance Win32_OperatingSystem).Caption

# Most recent installed updates, look for the Feb 2020 (or later) rollup KB
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

If the newest hotfix predates February 2020, or the machine has never received the monthly rollup for its branch, it is unpatched against CVE-2020-0683.

How to fix CVE-2020-0683

Microsoft fixed this in the February 2020 Patch Tuesday release (2020-02-11). There is no standalone hotfix to chase: the fix ships inside that month's cumulative update (for Windows 10 / Server 2016+) or monthly rollup / security-only update (for Windows 7, 8.1, and Server 2008–2012 R2). Install the current monthly update for your branch: any cumulative update from February 2020 onward already contains this fix because Windows 10 cumulative updates are superseding. Look up the exact KB for your build on the MSRC advisory or the Microsoft Update Catalog.

Fastest path: Windows Update (any branch)

On most hosts, simply taking the latest monthly quality update is enough, because it supersedes the February 2020 patch:

# Trigger an online scan + install via the Windows Update agent
# (Run from an elevated PowerShell prompt)
Install-Module PSWindowsUpdate -Force -Scope CurrentUser
Import-Module PSWindowsUpdate
Get-WindowsUpdate -MicrosoftUpdate -AcceptAll -Install -AutoReboot

No PSWindowsUpdate module? Use the built-in agent or the Settings UI:

# Built-in update scan/apply (Windows 10 / Server 2016+)
UsoClient StartScan
UsoClient StartDownload
UsoClient StartInstall
# Then: Settings > Update & Security > Windows Update > Restart now

Install a specific KB offline (WSUS / air-gapped)

For controlled rollouts, download the exact .msu for your build from the Update Catalog and stage it. Find your build's February 2020 (or later) KB on the MSRC advisory first, examples from that release include KB4532691 (Windows 10 1903/1909) and KB4537764 (Windows 7 SP1 monthly rollup); always confirm the current KB for your branch before deploying.

# Replace KBNNNNNNN with the KB ID from the MSRC advisory for YOUR build
$kb  = 'KBNNNNNNN'
$msu = "$env:TEMP\$kb.msu"
# Download the matching .msu from https://www.catalog.update.microsoft.com/ , then install:
Start-Process -FilePath 'wusa.exe' -ArgumentList "`"$msu`" /quiet /norestart" -Wait
Restart-Computer -Force

Detect, patch, and verify with DISM (scriptable)

This block checks the patch level, applies a staged .msu, and verifies the KB landed. all using Windows-native tooling. There is no Linux or package-manager path for this CVE; it is a Windows-only defect in the Windows Installer service.

# Vendor advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0683
# Run as Administrator
$ErrorActionPreference = 'Stop'
$kb  = 'KBNNNNNNN'                       # the Feb-2020-or-later KB for your build
$msu = "$env:TEMP\$kb.msu"               # staged update package
$log = "$env:ProgramData\CVE-2020-0683-patch.log"
function Write-Log($m){ "$(Get-Date -Format s)  $m" | Tee-Object -FilePath $log -Append }

Write-Log "Checking for $kb on $env:COMPUTERNAME"

if (Get-HotFix -Id $kb -ErrorAction SilentlyContinue) {
    Write-Log "Already installed: $kb. Nothing to do."
    return
}

if (-not (Test-Path $msu)) {
    throw "Update package not found at $msu. Download it from the Microsoft Update Catalog first."
}

# Apply with DISM (works for cumulative .msu/.cab on modern Windows)
Write-Log "Applying $msu ..."
dism.exe /Online /Add-Package /PackagePath:"$msu" /Quiet /NoRestart
Write-Log "DISM finished with exit code $LASTEXITCODE"

# Verify
if (Get-HotFix -Id $kb -ErrorAction SilentlyContinue) {
    Write-Log "SUCCESS: $kb is now installed. Reboot to complete."
} else {
    Write-Log "PENDING: $kb not yet listed, a reboot may be required before it registers."
}
Restart-Computer -Force

If you can't patch immediately

Microsoft published no workaround and no mitigation for CVE-2020-0683: the security update is the only documented fix. Because this is a local privilege-escalation bug in a SYSTEM service, network controls (firewall rules, port blocks, segmentation) do nothing to stop it. The exposure is anyone who can log on interactively to the box.

If you genuinely cannot deploy the February 2020 (or later) update on a given host, reduce who can exploit it rather than trying to block a port:

• Cut down interactive logon rights. Remove standard and shared accounts from any host that handles sensitive data until it is patched. Fewer local users means fewer accounts that can plant the malicious symlink.
• Restrict who can run installers. Confirm the "Always install with elevated privileges" Group Policy (Computer and User Configuration) is Disabled, when it is enabled it broadens the very SYSTEM-context install path this CVE abuses.
• Watch for symlink/junction creation in privileged paths. Enable object-access auditing on directories the installer writes to, and treat unexpected reparse points created by non-admin users as suspicious.
• Prioritize multi-user and jump hosts. Terminal servers, RDS hosts, and shared workstations are where a local-EoP bug pays off fastest for an attacker; patch those first.

List local accounts that could be used to stage an exploit, so you know your exposure window:

# Enumerate enabled local accounts that can log on interactively
Get-LocalUser | Where-Object { $_.Enabled } | Select-Object Name, LastLogon
# Confirm the elevated-install policy is OFF (value 0 or absent = safe)
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer' -Name AlwaysInstallElevated -ErrorAction SilentlyContinue

Resolve

After the reboot, confirm the February 2020 (or later) rollup is present. Check by KB or just confirm the most recent hotfix is from February 2020 onward:

# Confirm a specific KB landed (use your build's KB)
Get-HotFix -Id KBNNNNNNN -ErrorAction SilentlyContinue

# Or confirm the newest installed update is Feb 2020 or later
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

Expected result: the cumulative/rollup KB for your build appears with an InstalledOn date inside your patch window. If Get-HotFix shows nothing newer than January 2020, the machine is still vulnerable.

Then re-run any vulnerability scanner you used previously and confirm the CVE-2020-0683 finding has cleared. Because this was an actively exploited local-EoP bug, also review Security event logs for unexpected privilege use and for unfamiliar local accounts on any multi-user host that ran unpatched.

Frequently asked questions

Can CVE-2020-0683 be exploited remotely?

No. The CVSS vector is AV:L (local), so the attacker must already be able to run code on the machine with at least a low-privilege account. There is no network or unauthenticated path, and blocking ports does nothing for it. It is a privilege-escalation bug: it turns an existing low-privilege foothold into SYSTEM by abusing how Windows Installer follows symbolic links.

Which KB fixes CVE-2020-0683?

The fix shipped in the February 11, 2020 Patch Tuesday update. There is no single KB across all Windows versions. each branch has its own. For example, Windows 10 1903/1909 received KB4532691 and Windows 7 SP1 received the KB4537764 monthly rollup. Look up the exact KB for your build on the MSRC advisory, or just install the latest cumulative update, which already supersedes the February 2020 patch.

I run Windows 7 / Server 2008 R2, which are end of life, am I still exposed?

Windows 7 SP1 and Server 2008/2008 R2 were listed as affected and received this fix in their final supported updates (and through Extended Security Updates). If those hosts are now past their ESU coverage and unpatched, they remain permanently vulnerable to CVE-2020-0683 with no fix coming: isolate or retire them.

What if my vulnerability scanner still flags CVE-2020-0683 after I patch?

Confirm the machine actually rebooted, many of these updates only register the KB and close the finding after a restart. Then verify with Get-HotFix that the February 2020 (or later) rollup is present, and make sure the scanner's plugin database is current, since some scanners key off build numbers that lag the published fix metadata.

References

• Official vendor advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0683
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-0683
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Written by Sai Kiran Pandrala on 2026-05-25. Sourced from the official vendor advisory, the NVD record, and the CISA KEV listing. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Other defects in the same area that deserve attention during this patch cycle:

• How to Fix CVE-2020-0601: Spoofing in Windows
• How to Fix CVE-2020-1464: Windows Spoofing in Windows 10 Version 1803
• How to Fix CVE-2020-0646: Remote Code Execution
• How to Fix CVE-2020-1020: Remote Code Execution in Windows
• How to Fix CVE-2020-1350: Remote Code Execution in Windows Server