VYPR
← All advisories
High severity7.8NVD Advisory· Published Oct 16, 2020· Updated Jun 17, 2026

CVE-2020-16940

CVE-2020-16940

Description

An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles junction points. An attacker who successfully exploited this vulnerability could delete files and folders in an elevated context. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and delete files or folders of their choosing. The security update addresses the vulnerability by correcting how the Windows User Profile Service handles junction points.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

32
  • Microsoft/Windows 10 190910 versions
    cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*+ 9 more
    • cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*range: 10.0.0
    • cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:x86:*range: 10.0.0
  • Microsoft/Windows 10 1607v5
    cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
    Range: 10.0.0
  • Microsoft/Windows 10 1809v52 versions
    cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*+ 1 more
    • cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*range: 10.0.0
    • cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*range: 10.0.0
  • Microsoft/Windows 7v53 versions
    cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:x64:*+ 2 more
    • cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:x64:*range: 6.1.0
    • cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:x86:*range: 6.1.0
    • cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
  • Microsoft/Windows 8.1v52 versions
    cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:x86:*+ 1 more
    • cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:x86:*range: 6.3.0
    • cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
  • Microsoft/Windows Rt 8.1
    cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
  • Microsoft/Windows Server 20082 versions
    cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
  • Microsoft/Windows Server 2012v53 versions
    cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*+ 2 more
    • cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*range: 6.2.0
    • cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
  • Microsoft/Windows Server 2016v55 versions
    cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*range: 10.0.0
    • cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*
    • cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*
  • Microsoft/Windows Server 2019v52 versions
    cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*range: 10.0.0
    • cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
  • Microsoft/Windowsllm-fuzzy

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.