CVE-2020-17087 (Microsoft Windows Kernel Privilege Escalation)

What a Windows kernel privilege escalation means

A kernel privilege escalation flaw is dangerous because the kernel sits at the core of the operating system's trust boundary. If an attacker can move from a low-privilege foothold to kernel-level authority, they can often bypass normal user controls, alter security settings, and gain a much broader ability to persist or move laterally.

For this CVE, the key practical point is not the exploit detail but the trust shift it enables. A vulnerability in the Windows kernel can turn an ordinary endpoint compromise into a system compromise, which is why kernel issues are treated as high-value targets by attackers and high-priority items by defenders.

Why this vulnerability class is dangerous

Privilege escalation is dangerous because it can convert limited access into administrative control without needing to break in again. That matters most when an attacker already has a foothold through phishing, stolen credentials, remote access, or another initial access method.

Once kernel privilege is reached, the attacker may be able to disable security tooling, tamper with logging, load malicious components, or interact directly with protected system resources. In practice, that means the vulnerability can become an amplifier for almost any other compromise on the host.

For general vulnerability context and tracking, readers should use the CVE Program for the record itself and the NIST National Vulnerability Database for CVE metadata and vulnerability references.

How organisations check exposure and prioritise response

Exposure assessment starts with simple questions: where is Microsoft Windows running, which hosts are internet-facing or reachable from untrusted networks, and which systems have the vulnerable product or build in scope. Asset inventory is the foundation, because you cannot prioritise what you cannot find.

Defenders should also review vendor advisories and watch for any evidence that the issue is being exploited in the wild. CISA's inclusion of a CVE in the KEV catalogue is a strong operational signal that patching and compensating controls should move ahead of routine maintenance windows.

The best response is risk-based: focus first on endpoints and servers that are externally exposed, hold sensitive data, or have broad administrative reach. The Vulnerability Management Guide is a useful companion for asset scoping, KEV-based prioritisation, and verification after remediation.

Remediation, detection, and post-incident review

Remediation should follow the vendor's guidance for the exact CVE and affected build, with patching treated as the primary fix whenever it is available. If immediate patching is not possible, organisations should reduce exposure by limiting local admin use, restricting attack paths to the host, and tightening monitoring around privilege changes and unusual kernel-adjacent activity.

Detection should look for signs that a compromised endpoint has been used to escalate privileges, not just for the initial exploit attempt. After patching, review whether the host was already compromised before the fix, because a patch does not remove a pre-existing attacker foothold.

Post-patch compromise review should include validation of accounts, sessions, scheduled tasks, services, security products, and any changes made while the vulnerability was exploitable. If the host was used to steal credentials or expand access, rotation and recovery may be needed beyond the patched machine itself.

For attacker tradecraft around privilege escalation and follow-on movement, the MITRE ATT&CK Enterprise Matrix provides a broader threat-detection lens.

Risk and Threat Considerations

Kernel privilege escalation creates outsized risk because a single successful exploitation can collapse the normal separation between user space and system control. That makes it attractive both for post-exploitation operators and for malware that wants to disable defenses or persist more deeply on a Windows host.

Failure mechanism: An attacker first gains a foothold, then uses the kernel flaw to raise privilege, weaken local controls, and extend control over the compromised system.

Impact: The result can be full host compromise, stronger persistence, defence evasion, credential access, and faster lateral movement into other systems.

Practitioner Guidance

Why practitioners should care: Treat kernel privilege escalation as an endpoint-to-system escalation problem, not just a patching task. The real operational question is whether the host has already been used as a staging point for broader compromise.

What to watch for: Prioritise any Windows asset that is exposed, holds sensitive credentials, or sits in a high-trust segment. The NIST National Vulnerability Database and vendor advisories should guide version-specific action, while your own telemetry should answer whether compromise preceded remediation.

Practitioner takeaway: Patch quickly, but always pair the patch with a compromise review, because privilege escalation flaws often leave behind access that the fix alone will not remove.

Related resources from NHI Mgmt Group

• CVE-2020-1027 (Microsoft Windows Kernel Privilege Escalation)
• CVE-2024-38106 (Microsoft Windows Kernel Privilege Escalation)
• CVE-2015-6175 (Microsoft Windows Kernel Privilege Escalation)
• CVE-2018-8611 (Microsoft Windows Kernel Privilege Escalation)