What is the CVSS score of CVE-2020-1112?

CVE-2020-1112 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 3.7%.

Which versions of Windows BITS are affected by CVE-2020-1112?

Windows Background Intelligent Transfer Service contains a critical privilege escalation flaw (CVE-2020-1112, CVSS 8.5) enabling complete system compromise across millions of Windows 7-10 and Server…. A patch is available.

How to fix or mitigate CVE-2020-1112?

Within 24 hours, conduct a complete inventory of Windows systems running Background Intelligent Transfer Service (Windows 7 SP1 through Windows 10 version 1909, Windows Server 2008 through 2019) and verify patch availability through Windows Update infrastructure. Within 7 days, deploy the vendor-released security patch to development and staging environments for compatibility and regression testing. Within 30 days, roll out patches to all production systems, prioritizing domain controllers and systems with Internet-facing network services, and validate deployment success through Windows Update reporting and endpoint compliance tools.

Windows BITS CVE-2020-1112

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2020-05-21 secure@microsoft.com

Microsoft File Upload Windows Server 2008 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows 10 Windows 7 Windows 8 1 Windows Rt 8 1

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

Network-reachable BITS IIS endpoint requires low-privilege auth and high complexity; scope change to SYSTEM yields full CIA impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 19, 2026 - 17:45 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 19, 2026 - 17:45 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 19, 2026 - 17:22 vuln.today

cvss_changed

Severity Changed

Aug 19, 2026 - 17:22 NVD

CRITICAL HIGH

CVSS changed

Aug 19, 2026 - 17:22 NVD

9.9 (CRITICAL) 8.5 (HIGH)

CVE Published

May 21, 2020 - 23:15 nvd

CRITICAL 9.9

DescriptionNVD

An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) IIS module improperly handles uploaded content, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.

AnalysisAI

Elevation of privilege in the Windows Background Intelligent Transfer Service (BITS) IIS module enables an authenticated network attacker to upload specially crafted content that the module processes unsafely, resulting in full system compromise (C:H/I:H/A:H) with scope change to the underlying OS. The vulnerability affects a wide swath of the Windows ecosystem - from Windows 7 SP1 through Windows 10 1909 and all major Windows Server releases from 2008 through 2019. With an EPSS score of 3.68% placing it at the 88th percentile, exploitation probability is meaningfully elevated above the baseline despite no confirmed active exploitation or public exploit code at time of analysis.

Technical ContextAI

Background Intelligent Transfer Service (BITS) is a core Windows component designed for asynchronous, throttled file transfers, most prominently used by Windows Update. It includes an IIS server-side module that can receive and process uploaded content over HTTP/HTTPS. CWE-434 (Unrestricted Upload of File with Dangerous Type) identifies the root cause: the IIS module fails to properly validate or restrict the type or content of files submitted via upload requests, allowing a crafted payload to be processed in a privileged context. Per CPE strings in NVD, affected targets include Windows 10 RTM, 1607 (x86/x64), 1709, 1803, 1809, 1903, and 1909; Windows 7 SP1 (x64); and per advisory tags, Windows 8.1, Windows RT 8.1, Windows Server 2008, 2012, 2016, and 2019. The CVSS scope-change indicator (S:C) reflects that successful exploitation crosses a privilege boundary from the BITS service context into higher OS-level privileges.

RemediationAI

The primary remediation is applying the vendor-released patch via Microsoft's May 2020 Patch Tuesday update, referenced at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1112 and https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1112. An exact patched build version is not independently confirmed from the available input data beyond 'patch available per vendor advisory' - consult the MSRC advisory for precise KB article numbers applicable to each Windows version. As a compensating control pending patch deployment, administrators should audit IIS configurations to determine whether the BITS server extension is actively enabled and reachable; disabling or restricting access to the BITS IIS upload endpoint (e.g., via IIS Manager or network-layer controls) would eliminate the attack surface. Restricting which authenticated accounts can reach the BITS IIS endpoint via IP allowlisting or authentication policies reduces the attacker pool consistent with the PR:L requirement. Note that disabling BITS server-side upload functionality may impact internal software distribution workflows that rely on it.