Security readout for executives and security teams
Plain-English summary
This is a high-severity Microsoft Windows privilege escalation issue in Remote Access. An attacker already on an affected Windows system with low privileges could potentially gain broad control. The source bundle does not show internet-based remote exploitation or active exploitation evidence.
Executive priority
Treat as high priority for routine patch cycles, with faster handling for servers and shared endpoints. It is not supported by the provided evidence as an active-exploitation emergency, but successful exploitation could turn limited access into full system compromise.
Technical view
CVE-2020-17028 is a Windows Remote Access elevation-of-privilege vulnerability. CVSS 3.1 is 7.8 with local attack vector, low complexity, low privileges required, no user interaction, and high confidentiality, integrity, and availability impact. Affected systems include multiple Windows 10, Windows Server 2012 R2, 2016, 2019, and related Server Core releases.
Likely exposure
Exposure is most likely on unpatched Windows workstations and servers listed in Microsoft’s affected-product set, especially where standard users can sign in locally or execute code. The title mentions Remote Access, but the CVSS vector indicates local exploitation, not direct network exploitation.
Exploitation context
The bundle marks KEV as false and CVSS exploit maturity as unproven. That does not prove exploitation is impossible; it means the provided sources do not support claiming active exploitation. Treat this mainly as a post-access privilege escalation risk.
Researcher notes
Available evidence is sparse: no CWE, root-cause detail, exploit description, or KB identifiers are included in the bundle. The CPE list appears broad and includes some duplicate-looking mappings, so validate affected assets against Microsoft’s advisory and installed-update state.
Mitigation direction
- Review Microsoft’s MSRC advisory for the exact security updates.
- Patch affected Windows and Windows Server systems through approved update channels.
- Prioritize servers, shared workstations, and systems allowing low-privileged interactive access.
- Restrict unnecessary local logon and code execution paths for standard users.
- Monitor Microsoft guidance for supersedence or servicing changes.
Validation and detection
- Inventory hosts running the affected Windows versions listed in the bundle.
- Confirm relevant Microsoft security updates are installed on those hosts.
- Check vulnerability scanner results against Microsoft’s advisory, not only CPE matches.
- Verify Server Core systems are included in patch compliance reporting.
- Document any unsupported or unpatched systems as accepted exceptions or remediation work.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Privilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-17028 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17028CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.