CVE-2020-1286: Input Validation

Published Jun 9, 2020

Updated

A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the current user, aka 'Windows Shell Remote Code Execution Vulnerability'.

Affected Software

10 affected components

Microsoft Windows 10=1803

Microsoft Windows 10=1809

Microsoft Windows 10=1903

Microsoft Windows 10=1909

Microsoft Windows 10=2004

Microsoft Windows Server 2016=1803

Microsoft Windows Server 2016=1903

Microsoft Windows Server 2016=1909

Microsoft Windows Server 2016=2004

Microsoft Windows Server 2019

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1286

Event History

Jun 9, 2020

CVE Published

via MITRE·07:43 PM

Data Sourced

via MITRE·07:43 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-1286?

CVE-2020-1286 has a CVSS base score of 8.8, indicating a high severity level.

How do I fix CVE-2020-1286?

To fix CVE-2020-1286, ensure your Windows operating system is updated with the latest security patches from Microsoft.

What systems are affected by CVE-2020-1286?

CVE-2020-1286 affects several versions of Windows 10 and Windows Server 2016, along with Windows Server 2019.

What type of attack does CVE-2020-1286 enable?

CVE-2020-1286 enables remote code execution attacks, allowing attackers to run arbitrary code in the context of the current user.

What happens if CVE-2020-1286 is successfully exploited?

If CVE-2020-1286 is successfully exploited, an attacker could take control of the affected system, potentially compromising sensitive data.