How do you patch or mitigate CVE-2020-0938 (Microsoft Windows Adobe Font Manager Library Remote Code Execution)?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

CISA's required action for CVE-2020-0938 is to apply updates per vendor instructions. In practice, find every instance of Microsoft Windows in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

How to approach patching an actively exploited Windows RCE

Start with exposure, not the CVE label. Identify every Windows system that can run the affected component, then separate internet-facing, remote-access reachable, and internal-only assets so you can sequence remediation by blast radius. For an exploited flaw, the safest order is inventory, containment, update or mitigation, then verification that the exposure is actually gone.

Because this issue was used in the wild, treat it as more than a routine patch cycle. The practical question is whether the system can be updated immediately, temporarily isolated, or removed from service until the vendor fix is in place.

For prioritisation and emergency response to exploited vulnerabilities, use the Zero-Day and Exploited Vulnerabilities Guide as the operational playbook for time-critical triage, mitigation, and post-patch hunting.

What “apply updates per vendor instructions” means in practice

The vendor update is the primary remediation, but the operational work is validating where it must be applied, making sure the right Windows builds are covered, and confirming that the update completed cleanly. If the system cannot be patched right away, a documented mitigation is acceptable only as a temporary control, not a substitute for remediation.

When a workaround is the only immediate option, reduce exposure aggressively. Removing internet reachability, restricting inbound paths, or taking the product offline is often the only defensible choice if the vulnerable service cannot be safely updated and it has no business-critical reason to remain exposed.

Use the Vulnerability Management Guide to anchor the lifecycle around asset scope, prioritisation, exceptions, and post-remediation verification rather than treating the CVE as a one-off patch event.

Confirm the remediation path against the CISA Known Exploited Vulnerabilities Catalog and the vendor advisory, because KEV entries are the clearest signal that time-to-remediate should be measured in hours or days, not a normal patch window.

How to check for compromise after remediation

Patch completion does not answer whether the system was already used as an entry point. Review logs, endpoint telemetry, and any relevant application or service logs for signs of suspicious child processes, unusual service activity, new persistence, or other behaviour consistent with pre-patch exploitation. If the system exposed an interface to the internet or to broad internal access, assume the attacker may have had enough time to stage follow-on actions.

Where the vulnerable host handled sensitive sessions, credentials, or administrative access, review whether those credentials may need rotation as part of the incident response, especially if the system could have been used to run code under a privileged context. That decision depends on observed evidence, but it should be considered whenever exploitation could have enabled lateral movement.

If you need a broader reference for hunting and verification after emergency remediation, the Zero-Day and Exploited Vulnerabilities Guide also covers compromise assessment and follow-up checks that matter after the patch is installed.

Risk and Threat Considerations

An actively exploited Windows remote code execution flaw is dangerous because it can convert ordinary service exposure into arbitrary code execution before defenders have time to react. The main risk is not just initial compromise, but what the attacker can do after the first execution, especially if the affected system is reachable from the internet or trusted internal networks.

Failure mechanism: The attacker sends crafted input to the vulnerable component, gains code execution in the target process or host context, and then uses that foothold to deploy payloads, move laterally, or establish persistence before the patch is applied.

Impact: A successful exploit can lead to full host compromise, downstream credential exposure, service disruption, and follow-on intrusion across connected systems, which is why containment and post-patch hunting are part of the fix, not optional extras.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited CVEs require rapid identification, prioritization, and remediation of exposed assets.
Recommendation — Prioritise internet-facing and known-exploited vulnerabilities for immediate remediation.
NIST CSF 2.0	ID.RA-05 — Threats, vulnerabilities, likelihoods, and impacts are used to understand risk	KEV-listed exploitation and post-patch hunting depend on explicit risk-based vulnerability prioritization.
	PR.IP-12 — Vulnerability management is performed	The question is about patching and mitigating a live vulnerability across an estate.
Recommendation — Use KEV status and exposure to rank remediation urgency. Apply and verify remediation through a defined vulnerability management process.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The core task is to apply vendor updates or mitigations for a known software flaw.
	RA-5 — Vulnerability Monitoring and Scanning	Exposure confirmation and post-remediation verification require finding affected instances and checking residual exposure.
Recommendation — Remediate the flaw with vendor-approved updates or compensating mitigations. Scan for affected hosts, confirm remediation, and recheck for residual exposure.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	The flaw was exploited in the wild through reachable software exposure.
	T1059 — Command and Scripting Interpreter	RCE remediation must assume attacker code execution and script-based follow-on activity may occur.
Recommendation — Hunt for exploitation paths against exposed services and prioritize internet-reachable targets. Check for post-exploit command execution and suspicious child processes.

Practitioner Guidance

What to prioritise: Patch or contain internet-facing and remotely reachable Windows instances first, then move to internal systems with privileged adjacency or sensitive data access. If the vendor fix cannot be deployed immediately, shorten exposure rather than waiting for a perfect maintenance window.

What to verify: Do not trust a deployment ticket alone. Verify the update landed on every in-scope system, confirm the vulnerable service is no longer exposed where it should not be, and check that compensating controls did not introduce a hidden outage or bypass path.

Escalation / exception: If a business owner asks to defer remediation, treat it as a formal exception only when the host is isolated, monitored, and the residual risk is explicitly accepted. If the system remains internet-facing or can be reached by untrusted users, deferral is usually not a reasonable exception.

Practitioner takeaway: For an exploited RCE, remediation is really a three-part decision: reduce exposure, apply the fix or mitigation, and then prove the system was not already used as a launch point.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org