How to Fix CVE-2020-1027: Windows Kernel Elevation of Privilege

Actively exploited. Listed in the CISA Known Exploited Vulnerabilities catalog since 2022-05-23; federal civilian agencies must remediate by 2022-06-13. Patch on an emergency cycle if the system is internet-exposed.

What is CVE-2020-1027?

CVE-2020-1027 is an elevation-of-privilege (EoP) vulnerability in the Windows Kernel. In Microsoft's own words, it “exists in the way that the Windows Kernel handles objects in memory.” The CVE Program tags the underlying defect as CWE-787: Out-of-bounds Write, code in the kernel writes past the bounds of an allocated object, corrupting adjacent memory that an attacker controls. Microsoft assigned it the generic name “Windows Kernel Elevation of Privilege Vulnerability,” and the record notes it is distinct from three sibling kernel bugs patched the same month: CVE-2020-0913, CVE-2020-1000, and CVE-2020-1003.

This is not a remote code execution bug, and it is not a denial of service. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.8 (High). Read that vector carefully, because it drives how you prioritise:

• AV:L (Local). the attacker must already be able to execute code on the machine. They cannot trigger this across the network from an unauthenticated position.
• PR:L (Privileges Required: Low), they need a foothold, but only a standard, non-administrative user account.
• C:H/I:H/A:H: once triggered, the impact is total. An out-of-bounds write in kernel memory lets the attacker overwrite kernel structures and run their own code at SYSTEM / ring 0.

In practice this is the second half of a real-world attack chain. An intruder lands on a workstation through phishing, a malicious document macro, or a stolen low-privilege credential, then fires an EoP like CVE-2020-1027 to jump from “some user” to “owns the box.” With SYSTEM rights they disable Defender, dump LSASS for more credentials, install a service-level implant, and move laterally. That is exactly why CISA added a local-only flaw to the Known Exploited Vulnerabilities catalog, privilege escalation is the pivot that turns a single compromised laptop into a domain-wide incident.

Am I affected?

CVE-2020-1027 affects a very wide span of Windows. from Windows 7 SP1 and Windows Server 2008 SP2 right up through Windows 10 1909 and Windows Server 2019. The full build matrix is in the Affected row above and in the MSRC advisory. If a host has not taken a Windows security update since April 2020, assume it is vulnerable.

Confirm the patch state directly rather than guessing from the OS name. On any affected host, open an elevated PowerShell prompt and list installed updates:

# Show OS build and the most recently installed security updates
[System.Environment]::OSVersion.Version
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object HotFixID, InstalledOn -First 15

If the newest InstalledOn date predates the April 2020 Patch Tuesday (2020-04-14), or there is no security rollup at all: the kernel fix is missing. There is no event-log signature you can rely on to detect exploitation after the fact; an out-of-bounds kernel write rarely leaves a clean trace, which is another reason to patch rather than monitor.

How to fix CVE-2020-1027

The fix is the April 14, 2020 Windows security update for your specific build, delivered through Microsoft's normal OS update channel. There is no separate downloadable “Windows” application to upgrade and no Linux package, this is the operating system kernel, so it is serviced by Windows Update, WSUS, Microsoft Update for Business, or the Microsoft Update Catalog. Pick the path that matches how you manage patches.

Windows Update (PowerShell, run as administrator)

# Trigger Windows Update scan and install (requires PSWindowsUpdate or built-in usoclient)
Install-Module PSWindowsUpdate -Force -Scope CurrentUser -ErrorAction SilentlyContinue
Import-Module PSWindowsUpdate
Get-WindowsUpdate -Install -AcceptAll -AutoReboot -IgnoreReboot -Category SecurityUpdates

# Confirm the security update tied to this CVE is listed
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 20

Windows (no PSWindowsUpdate, fallback)

# Force scan from native scheduler
(New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()
Start-Process "$env:windir\System32\UsoClient.exe" -ArgumentList "StartScan"
Start-Process "$env:windir\System32\UsoClient.exe" -ArgumentList "StartDownload"
Start-Process "$env:windir\System32\UsoClient.exe" -ArgumentList "StartInstall"

Manual install from the Microsoft Update Catalog

For air-gapped or update-disabled hosts, download the standalone MSU for your exact build from the Microsoft Update Catalog and install it with wusa.exe. Match the KB to your OS version (for example the April 2020 cumulative update / monthly rollup for that build). installing the wrong-architecture or wrong-build MSU simply fails with 0x80240017.

# Download the correct MSU for YOUR build from the Update Catalog, then:
$msu = "$env:USERPROFILE\Downloads\windows10.0-kb4549951-x64.msu"   # example KB; use the one for your build
wusa.exe $msu /quiet /norestart
# Reboot to finalise the kernel update
shutdown.exe /r /t 60 /c "Reboot to finalise CVE-2020-1027 security update"

Fleet deployment (WSUS / Configuration Manager)

# On a managed client, force a detect + install cycle against your WSUS/SCCM point:
(New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()
UsoClient.exe StartScan
UsoClient.exe StartDownload
UsoClient.exe StartInstall

# Trigger the Configuration Manager Software Updates scan cycle (if SCCM-managed):
Invoke-WmiMethod -Namespace root\ccm -Class SMS_Client -Name TriggerSchedule `
  -ArgumentList "{00000000-0000-0000-0000-000000000113}"

Verify the kernel fix landed

# Confirm the security rollup is present and the box has rebooted into it
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object HotFixID, InstalledOn -First 10

# Check that the patched kernel binary is in place (build/revision should match the April 2020+ servicing level)
(Get-Item "$env:windir\System32\ntoskrnl.exe").VersionInfo.FileVersion

A successful patch raises the file version of ntoskrnl.exe (the Windows kernel image) to the April 2020 servicing level or later. After the update installs you must reboot, kernel updates are not live and the host stays vulnerable until it restarts into the new build.

If you can't patch immediately

There is no registry workaround or feature toggle that neutralises CVE-2020-1027: Microsoft published no mitigation, only the update. Because the flaw requires a local foothold (AV:L, PR:L), the only meaningful interim controls reduce the chance an attacker reaches the host in the first place:

• Enforce least privilege. Remove standing local-admin rights so a compromised account has less to chain from, and so unsigned tooling is harder to run.
• Application control. Block untrusted executables with AppLocker or Windows Defender Application Control; most EoP exploits arrive as a dropped binary the user was tricked into running.
• EDR in block mode. Keep Microsoft Defender (or your EDR) in active/block mode with tamper protection on, so a SYSTEM-level exploit cannot silently disable it.
• Isolate legacy hosts. Windows 7 SP1 and Server 2008/2008 R2 are out of mainstream support; if you still run them, segment them away from the rest of the estate and prioritise their patching or retirement.

These are stop-gaps. They lower the odds of a successful chain; they do not remove the vulnerability. Schedule the security update on an emergency change window.

Full fix path

1. Reboot, then re-run Get-HotFix and check the ntoskrnl.exe file version from the fix section. The host must be running the April 2020 (or later) servicing level for your build.
2. Re-run an authenticated vulnerability scan (Nessus, Qualys, OpenVAS, Microsoft Defender Vulnerability Management) targeting the patched host. CVE-2020-1027 must no longer be reported.
3. Pull the latest service logs and search for the exploitation signatures in the vendor advisory. Treat any match before the patch timestamp as a possible compromise: isolate the host, rotate credentials the affected process could see, and run a full IR triage.
4. Confirm any compensating control you put in place (firewall rules, sysctl, registry edits) is either intentionally left in place or rolled back, with the change documented in your CMDB.

Is CVE-2020-1027 remote code execution?

No. It is an elevation-of-privilege flaw in the Windows Kernel. The attacker must already be running code on the host as a low-privileged user; the bug lets them escalate to SYSTEM. The CVSS vector AV:L/PR:L confirms it is local privilege escalation, not a remote pre-auth vulnerability. It is dangerous because attackers chain it after an initial foothold to take full control of the machine.

How do I patch CVE-2020-1027?

Install the April 14, 2020 Windows security update for your build through Windows Update, WSUS, Microsoft Update for Business, or the Microsoft Update Catalog, then reboot. There is no standalone application to upgrade and no Linux package, the Windows kernel is serviced through the OS update channel only. Apply the cumulative update or monthly rollup that carries the fix for your exact OS version.

Why is a CVSS 7.8 local-only bug in the CISA KEV catalog?

Because it is being actively exploited. Local privilege-escalation bugs are the workhorse of real intrusions: an attacker lands with phishing or a stolen low-privilege account, then chains an EoP like CVE-2020-1027 to gain SYSTEM, disable defenses, and move laterally. CISA added it on 2022-05-23 with a federal remediation deadline of 2022-06-13.

How do I confirm the patch is applied?

After rebooting, run Get-HotFix and confirm the relevant April 2020 (or later) KB is installed, or check that ntoskrnl.exe is at the April 2020+ servicing level. An authenticated scan with Nessus, Qualys, or Microsoft Defender Vulnerability Management should then report the host as no longer vulnerable.

References

• Official vendor advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1027
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2020-1027
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• http://packetstormsecurity.com/files/168068/Windows-sxs-CNodeFactory-XMLParser_Element_doc_assembly_assemblyIdentity-Heap-Buffer-Overflow.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1027

This guide was assembled from the official vendor advisory, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Other flaws in this area worth reviewing while you patch this one:

• How to Fix CVE-2020-0938: Remote Code Execution in Windows
• How to Fix CVE-2020-0601: Spoofing in Windows
• How to Fix CVE-2020-1380: Scripting Engine Memory Corruption in Internet Explorer 11
• How to Fix CVE-2020-0674: Remote Code Execution in Internet Explorer 10
• How to Fix CVE-2020-1040: Remote Code Execution in Windows Server