Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management

What to do

1. Check which version of Windows you run against the affected versions below, and install the vendor's latest release.
2. CISA's required action: Apply updates per vendor instructions.
3. Read the advisory on portal.msrc.microsoft.com for workarounds and exact fixed builds.
4. Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.

Affected products and versions

Version data comes from the organisation that assigned the CVE; 2 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector

LocalThe attacker needs local access or must trick a user into running something.

Attack complexity

LowNo special conditions are needed; the attack works reliably.

Privileges required

NoneNo account or login is needed.

User interaction

RequiredA user must take an action such as opening a file or link.

Scope

UnchangedImpact stays within the vulnerable component.

Confidentiality

HighAll data handled by the component can be read.

Integrity

HighData or code can be modified at will.

Availability

HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Link Resolution Before File Access

Timeline

1. March 12, 2020CVE record published.
2. November 23, 2021CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
3. January 28, 2022Added to CISA's Known Exploited Vulnerabilities catalogue.
4. July 28, 2022Deadline for US federal agencies to remediate, set by CISA.
5. August 12, 2026Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Windows

• 7.4 High severity

  Windows: Unprotected Alternate Channel

  CVE-2025-59033Sep 8, 2025Microsoft
• 7.4 High severity

  Windows: Missing Synchronization

  CVE-2022-50238Sep 8, 2025Microsoft
• 7.8 High severity

  Windows: User Interface (UI) Misrepresentation of Critical Information

  CVE-2025-9491Aug 26, 2025MicrosoftEPSS 76%
• 7.5 High severity

  Windows: NULL Pointer Dereference

  CVE-2022-40732Dec 18, 2024Microsoft
• 7.0 High severity

  McAfee Total Protection for Windows: Time-of-check Time-of-use (TOCTOU) Race Condition

  CVE-2022-0280Mar 10, 2022McAfee
• 7.8 High severity

  Microsoft Windows Kernel Privilege Escalation Exploited

  CVE-2020-0986Jun 9, 2020MicrosoftEPSS 16.4%

Recent Improper Link Resolution Before File Access vulnerabilities

• 7.8 High severity

  Microsoft Windows Installer Privilege Escalation Exploited

  CVE-2020-0683Feb 11, 2020MicrosoftEPSS 7.67%
• 7.8 High severity

  Microsoft Update Notification Manager Privilege Escalation Exploited

  CVE-2020-0638Jan 14, 2020MicrosoftEPSS 2.54%
• 7.8 High severity

  Microsoft Windows AppX Deployment Extensions Privilege Escalation Exploited

  CVE-2019-1385Nov 12, 2019MicrosoftEPSS 3.6%
• 7.8 High severity

  Microsoft Windows Error Reporting Manager Privilege Escalation Exploited

  CVE-2019-1315Oct 10, 2019MicrosoftEPSS 3.48%
• 7.8 High severity

  Microsoft Windows AppX Deployment Server Privilege Escalation Exploited

  CVE-2019-1253Sep 11, 2019MicrosoftEPSS 11.6%
• 7.8 High severity

  Microsoft Windows AppX Deployment Service Privilege Escalation Exploited

  CVE-2019-1130Jul 15, 2019MicrosoftEPSS 1.72%

Spotted an error? Tell us.