---
id: CVE-2020-1002
title: >-
  An elevation of privilege vulnerability exists when the MpSigStub.exe for
  Defender allows file deletion in arbitrary locations.To exploit the
  vulnerability, an attacker would first have to log on to the system, aka
  'Microsoft Defender El…
summary: >-
  An elevation of privilege vulnerability exists when the MpSigStub.exe for
  Defender allows file deletion in arbitrary locations.To exploit the
  vulnerability, an attacker would first have to log on to the system, aka
  'Microsoft Defender El…
severity: none
vendor: Microsoft
product: Microsoft Forefront Endpoint Protection
affected:
  - forefront_endpoint_protection 2010
  - system_center Endpoint Protection
  - system_center 2012 R2 Endpoint Protection
  - system_center 2012 Endpoint Protection
  - security_essentials unspecified
  - windows_defender_on_windows_10_version_1909_for_32-bit_systems unspecified
  - >-
    windows_defender_on_windows_10_version_1909_for_x64-based_systems
    unspecified
  - >-
    windows_defender_on_windows_10_version_1909_for_arm64-based_systems
    unspecified
  - >-
    windows_defender_on_windows_server_version_1909_server_core_installation
    unspecified
  - windows_defender_on_windows_10_version_1803_for_32-bit_systems unspecified
  - >-
    windows_defender_on_windows_10_version_1803_for_x64-based_systems
    unspecified
  - >-
    windows_defender_on_windows_server_version_1803_server_core_installation
    unspecified
  - >-
    windows_defender_on_windows_10_version_1803_for_arm64-based_systems
    unspecified
  - windows_defender_on_windows_10_version_1809_for_32-bit_systems unspecified
  - >-
    windows_defender_on_windows_10_version_1809_for_x64-based_systems
    unspecified
  - >-
    windows_defender_on_windows_10_version_1809_for_arm64-based_systems
    unspecified
  - windows_defender_on_windows_server_2019 unspecified
  - windows_defender_on_windows_server_2019_server_core_installation unspecified
  - windows_defender_on_windows_10_version_1709_for_32-bit_systems unspecified
  - >-
    windows_defender_on_windows_10_version_1709_for_x64-based_systems
    unspecified
  - >-
    windows_defender_on_windows_10_version_1709_for_arm64-based_systems
    unspecified
  - windows_defender_on_windows_10_version_1903_for_32-bit_systems unspecified
  - >-
    windows_defender_on_windows_10_version_1903_for_x64-based_systems
    unspecified
  - >-
    windows_defender_on_windows_10_version_1903_for_arm64-based_systems
    unspecified
  - >-
    windows_defender_on_windows_server_version_1903_server_core_installation
    unspecified
  - windows_defender_on_windows_10_for_32-bit_systems unspecified
  - windows_defender_on_windows_10_for_x64-based_systems unspecified
  - windows_defender_on_windows_10_version_1607_for_32-bit_systems unspecified
  - >-
    windows_defender_on_windows_10_version_1607_for_x64-based_systems
    unspecified
  - windows_defender_on_windows_server_2016 unspecified
  - windows_defender_on_windows_server_2016_server_core_installation unspecified
  - windows_defender_on_windows_7_for_32-bit_systems Service Pack 1
  - windows_defender_on_windows_7_for_x64-based_systems Service Pack 1
  - windows_defender_on_windows_8.1_for_32-bit_systems unspecified
  - windows_defender_on_windows_8.1_for_x64-based_systems unspecified
  - windows_defender_on_windows_rt_8.1 unspecified
  - windows_defender_on_windows_server_2008_for_32-bit_systems Service Pack 2
  - >-
    windows_defender_on_windows_server_2008_for_32-bit_systems_server_core_installation
    Service Pack 2
  - >-
    windows_defender_on_windows_server_2008_for_itanium-based_systems Service
    Pack 2
  - >-
    windows_defender_on_windows_server_2008_r2_for_itanium-based_systems Service
    Pack 1
  - >-
    windows_defender_on_windows_server_2008_r2_for_x64-based_systems Service
    Pack 1
  - >-
    windows_defender_on_windows_server_2008_r2_for_x64-based_systems_server_core_installation
    Service Pack 1
  - windows_defender_on_windows_server_2012 unspecified
  - windows_defender_on_windows_server_2012_server_core_installation unspecified
  - windows_defender_on_windows_server_2012_r2 unspecified
  - >-
    windows_defender_on_windows_server_2012_r2_server_core_installation
    unspecified
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T17:53:21.319537Z'
published: '2020-04-15'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T17:53:27.643Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2020-1002'
references:
  - url: >-
      https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1002
tags:
  - cve.org
epss: 0.00737
epssPercentile: 0.54754
ingestedAt: '2026-11-05T19:30:42.753Z'
---

## Overview

An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Defender Elevation of Privilege Vulnerability'.

## Affected

- `forefront_endpoint_protection 2010`
- `system_center Endpoint Protection`
- `system_center 2012 R2 Endpoint Protection`
- `system_center 2012 Endpoint Protection`
- `security_essentials unspecified`
- `windows_defender_on_windows_10_version_1909_for_32-bit_systems unspecified`
- `windows_defender_on_windows_10_version_1909_for_x64-based_systems unspecified`
- `windows_defender_on_windows_10_version_1909_for_arm64-based_systems unspecified`
- `windows_defender_on_windows_server_version_1909_server_core_installation unspecified`
- `windows_defender_on_windows_10_version_1803_for_32-bit_systems unspecified`
- `windows_defender_on_windows_10_version_1803_for_x64-based_systems unspecified`
- `windows_defender_on_windows_server_version_1803_server_core_installation unspecified`
- `windows_defender_on_windows_10_version_1803_for_arm64-based_systems unspecified`
- `windows_defender_on_windows_10_version_1809_for_32-bit_systems unspecified`
- `windows_defender_on_windows_10_version_1809_for_x64-based_systems unspecified`
- `windows_defender_on_windows_10_version_1809_for_arm64-based_systems unspecified`
- `windows_defender_on_windows_server_2019 unspecified`
- `windows_defender_on_windows_server_2019_server_core_installation unspecified`
- `windows_defender_on_windows_10_version_1709_for_32-bit_systems unspecified`
- `windows_defender_on_windows_10_version_1709_for_x64-based_systems unspecified`
- `windows_defender_on_windows_10_version_1709_for_arm64-based_systems unspecified`
- `windows_defender_on_windows_10_version_1903_for_32-bit_systems unspecified`
- `windows_defender_on_windows_10_version_1903_for_x64-based_systems unspecified`
- `windows_defender_on_windows_10_version_1903_for_arm64-based_systems unspecified`
- `windows_defender_on_windows_server_version_1903_server_core_installation unspecified`
- `windows_defender_on_windows_10_for_32-bit_systems unspecified`
- `windows_defender_on_windows_10_for_x64-based_systems unspecified`
- `windows_defender_on_windows_10_version_1607_for_32-bit_systems unspecified`
- `windows_defender_on_windows_10_version_1607_for_x64-based_systems unspecified`
- `windows_defender_on_windows_server_2016 unspecified`
- `windows_defender_on_windows_server_2016_server_core_installation unspecified`
- `windows_defender_on_windows_7_for_32-bit_systems Service Pack 1`
- `windows_defender_on_windows_7_for_x64-based_systems Service Pack 1`
- `windows_defender_on_windows_8.1_for_32-bit_systems unspecified`
- `windows_defender_on_windows_8.1_for_x64-based_systems unspecified`
- `windows_defender_on_windows_rt_8.1 unspecified`
- `windows_defender_on_windows_server_2008_for_32-bit_systems Service Pack 2`
- `windows_defender_on_windows_server_2008_for_32-bit_systems_server_core_installation Service Pack 2`
- `windows_defender_on_windows_server_2008_for_itanium-based_systems Service Pack 2`
- `windows_defender_on_windows_server_2008_r2_for_itanium-based_systems Service Pack 1`
- `windows_defender_on_windows_server_2008_r2_for_x64-based_systems Service Pack 1`
- `windows_defender_on_windows_server_2008_r2_for_x64-based_systems_server_core_installation Service Pack 1`
- `windows_defender_on_windows_server_2012 unspecified`
- `windows_defender_on_windows_server_2012_server_core_installation unspecified`
- `windows_defender_on_windows_server_2012_r2 unspecified`
- `windows_defender_on_windows_server_2012_r2_server_core_installation unspecified`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.