An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic…

cisa required action Apply updates per vendor instructions.

1. 2020-03-10 First public exploit (Metasploit exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move)
2. 2020-03-12 Published
3. 2021-11-23 CISA SSVC: exploitation active
4. 2022-01-28 Added to CISA KEV
5. 2022-07-28 CISA patch deadline

Added

4 y ago (2022-01-28)

Patch by

2022-07-28 (4 y ago)

Ransomware

Known to be used in ransomware campaigns

Required action

Apply updates per vendor instructions.

Vendor, product

Microsoft, Windows

CISA name

Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability

Groups reported to have exploited it in intrusions.

• RansomHub ransomware gang

reported by cisa.gov

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

How it is exploited and what it leads to, in MITRE ATT&CK terms.

• T1068 Exploitation for Privilege Escalation exploitation
• T1059 Command and Scripting Interpreter primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

Exploitation

Active, exploited in the wild

Automatable

no

Technical impact

total

Assessed

4 y ago (2021-11-23)

42.52% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Metasploit exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move Background Intelligent Transfer Service Arbitrary File Move Privilege Elevation Vulnerability metasploit exploit, excellent rank, 2020-03-10
• packetstormsecurity.com http://packetstormsecurity.com/files/158056/Background-Intelligent-Transfer-Service-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified

• Microsoft Windows
• Microsoft Windows Server
• Microsoft Windows 10 Version 1909 for 32-bit Systems
• Microsoft Windows 10 Version 1909 for x64-based Systems
• Microsoft Windows 10 Version 1909 for ARM64-based Systems
• Microsoft Windows Server, version 1909 (Server Core installation)
• Microsoft Windows 10 Version 1903 for 32-bit Systems
• Microsoft Windows 10 Version 1903 for x64-based Systems
• Microsoft Windows 10 Version 1903 for ARM64-based Systems
• Microsoft Windows Server, version 1903 (Server Core installation)

Weakness

• CWE-59 Improper Link Resolution Before File Access

• portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2020-0787

  patch, vendor-advisory

• packetstormsecurity.com /files/158056/Background-Intelligent-Transfer-Service-Privilege-Escalation.html

  exploit, third-party-advisory, vdb-entry

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0787

  government-resource, us-government-resource

• CVE List CVE-2020-0787
• NVD CVE-2020-0787

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.