{"id":"CVE-2020-1002","title":"An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Defender El…","summary":"An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Defender El…","severity":"none","vendor":"Microsoft","product":"Microsoft Forefront Endpoint Protection","affected":["forefront_endpoint_protection 2010","system_center Endpoint Protection","system_center 2012 R2 Endpoint Protection","system_center 2012 Endpoint Protection","security_essentials unspecified","windows_defender_on_windows_10_version_1909_for_32-bit_systems unspecified","windows_defender_on_windows_10_version_1909_for_x64-based_systems unspecified","windows_defender_on_windows_10_version_1909_for_arm64-based_systems unspecified","windows_defender_on_windows_server_version_1909_server_core_installation unspecified","windows_defender_on_windows_10_version_1803_for_32-bit_systems unspecified","windows_defender_on_windows_10_version_1803_for_x64-based_systems unspecified","windows_defender_on_windows_server_version_1803_server_core_installation unspecified","windows_defender_on_windows_10_version_1803_for_arm64-based_systems unspecified","windows_defender_on_windows_10_version_1809_for_32-bit_systems unspecified","windows_defender_on_windows_10_version_1809_for_x64-based_systems unspecified","windows_defender_on_windows_10_version_1809_for_arm64-based_systems unspecified","windows_defender_on_windows_server_2019 unspecified","windows_defender_on_windows_server_2019_server_core_installation unspecified","windows_defender_on_windows_10_version_1709_for_32-bit_systems unspecified","windows_defender_on_windows_10_version_1709_for_x64-based_systems unspecified","windows_defender_on_windows_10_version_1709_for_arm64-based_systems unspecified","windows_defender_on_windows_10_version_1903_for_32-bit_systems unspecified","windows_defender_on_windows_10_version_1903_for_x64-based_systems unspecified","windows_defender_on_windows_10_version_1903_for_arm64-based_systems unspecified","windows_defender_on_windows_server_version_1903_server_core_installation unspecified","windows_defender_on_windows_10_for_32-bit_systems unspecified","windows_defender_on_windows_10_for_x64-based_systems unspecified","windows_defender_on_windows_10_version_1607_for_32-bit_systems unspecified","windows_defender_on_windows_10_version_1607_for_x64-based_systems unspecified","windows_defender_on_windows_server_2016 unspecified","windows_defender_on_windows_server_2016_server_core_installation unspecified","windows_defender_on_windows_7_for_32-bit_systems Service Pack 1","windows_defender_on_windows_7_for_x64-based_systems Service Pack 1","windows_defender_on_windows_8.1_for_32-bit_systems unspecified","windows_defender_on_windows_8.1_for_x64-based_systems unspecified","windows_defender_on_windows_rt_8.1 unspecified","windows_defender_on_windows_server_2008_for_32-bit_systems Service Pack 2","windows_defender_on_windows_server_2008_for_32-bit_systems_server_core_installation Service Pack 2","windows_defender_on_windows_server_2008_for_itanium-based_systems Service Pack 2","windows_defender_on_windows_server_2008_r2_for_itanium-based_systems Service Pack 1","windows_defender_on_windows_server_2008_r2_for_x64-based_systems Service Pack 1","windows_defender_on_windows_server_2008_r2_for_x64-based_systems_server_core_installation Service Pack 1","windows_defender_on_windows_server_2012 unspecified","windows_defender_on_windows_server_2012_server_core_installation unspecified","windows_defender_on_windows_server_2012_r2 unspecified","windows_defender_on_windows_server_2012_r2_server_core_installation unspecified"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-02T17:53:21.319537Z"},"published":"2020-04-15","updated":"2026-11-02","sourceUpdated":"2026-11-02T17:53:27.643Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2020-1002","references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1002"}],"tags":["cve.org"],"epss":0.00737,"epssPercentile":0.54754,"ingestedAt":"2026-11-05T19:30:42.753Z","slug":"CVE-2020-1002","body":"## Overview\n\nAn elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Defender Elevation of Privilege Vulnerability'.\n\n## Affected\n\n- `forefront_endpoint_protection 2010`\n- `system_center Endpoint Protection`\n- `system_center 2012 R2 Endpoint Protection`\n- `system_center 2012 Endpoint Protection`\n- `security_essentials unspecified`\n- `windows_defender_on_windows_10_version_1909_for_32-bit_systems unspecified`\n- `windows_defender_on_windows_10_version_1909_for_x64-based_systems unspecified`\n- `windows_defender_on_windows_10_version_1909_for_arm64-based_systems unspecified`\n- `windows_defender_on_windows_server_version_1909_server_core_installation unspecified`\n- `windows_defender_on_windows_10_version_1803_for_32-bit_systems unspecified`\n- `windows_defender_on_windows_10_version_1803_for_x64-based_systems unspecified`\n- `windows_defender_on_windows_server_version_1803_server_core_installation unspecified`\n- `windows_defender_on_windows_10_version_1803_for_arm64-based_systems unspecified`\n- `windows_defender_on_windows_10_version_1809_for_32-bit_systems unspecified`\n- `windows_defender_on_windows_10_version_1809_for_x64-based_systems unspecified`\n- `windows_defender_on_windows_10_version_1809_for_arm64-based_systems unspecified`\n- `windows_defender_on_windows_server_2019 unspecified`\n- `windows_defender_on_windows_server_2019_server_core_installation unspecified`\n- `windows_defender_on_windows_10_version_1709_for_32-bit_systems unspecified`\n- `windows_defender_on_windows_10_version_1709_for_x64-based_systems unspecified`\n- `windows_defender_on_windows_10_version_1709_for_arm64-based_systems unspecified`\n- `windows_defender_on_windows_10_version_1903_for_32-bit_systems unspecified`\n- `windows_defender_on_windows_10_version_1903_for_x64-based_systems unspecified`\n- `windows_defender_on_windows_10_version_1903_for_arm64-based_systems unspecified`\n- `windows_defender_on_windows_server_version_1903_server_core_installation unspecified`\n- `windows_defender_on_windows_10_for_32-bit_systems unspecified`\n- `windows_defender_on_windows_10_for_x64-based_systems unspecified`\n- `windows_defender_on_windows_10_version_1607_for_32-bit_systems unspecified`\n- `windows_defender_on_windows_10_version_1607_for_x64-based_systems unspecified`\n- `windows_defender_on_windows_server_2016 unspecified`\n- `windows_defender_on_windows_server_2016_server_core_installation unspecified`\n- `windows_defender_on_windows_7_for_32-bit_systems Service Pack 1`\n- `windows_defender_on_windows_7_for_x64-based_systems Service Pack 1`\n- `windows_defender_on_windows_8.1_for_32-bit_systems unspecified`\n- `windows_defender_on_windows_8.1_for_x64-based_systems unspecified`\n- `windows_defender_on_windows_rt_8.1 unspecified`\n- `windows_defender_on_windows_server_2008_for_32-bit_systems Service Pack 2`\n- `windows_defender_on_windows_server_2008_for_32-bit_systems_server_core_installation Service Pack 2`\n- `windows_defender_on_windows_server_2008_for_itanium-based_systems Service Pack 2`\n- `windows_defender_on_windows_server_2008_r2_for_itanium-based_systems Service Pack 1`\n- `windows_defender_on_windows_server_2008_r2_for_x64-based_systems Service Pack 1`\n- `windows_defender_on_windows_server_2008_r2_for_x64-based_systems_server_core_installation Service Pack 1`\n- `windows_defender_on_windows_server_2012 unspecified`\n- `windows_defender_on_windows_server_2012_server_core_installation unspecified`\n- `windows_defender_on_windows_server_2012_r2 unspecified`\n- `windows_defender_on_windows_server_2012_r2_server_core_installation unspecified`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}