Actively exploited in the wild
Microsoft Update Notification Manager Privilege Escalation Vulnerability
Microsoft - Update Notification Manager · Listed in the CISA KEV since 2022-05-23. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-0638
HighCVSS 7.8KEVExploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files. To exploit, an attacker would first have to gain execution on the victim system.
Risk Assessment
Privilege escalation after gaining code execution.
Recommendation
Install Windows security updates.
Related vulnerabilities
- CVE-2026-88773Critical
HTTP Request/Response Smuggling vulnerability in Citrix NetScaler ADC and Gateway due to inconsistent interpretation of HTTP requests.
- CVE-2026-88772Critical
Vulnerability in Citrix NetScaler ADC and Gateway leading to Remote Code Execution or Denial of Service.
- CVE-2026-88771Critical
Improper input validation in Citrix NetScaler ADC and Gateway allows an unauthenticated attacker to execute arbitrary commands.
- CVE-2026-100741Critical
Eval injection vulnerability in hMailServer (versions 6.0.0-6.3.3) allows a remote, unauthenticated attacker to execute arbitrary JScript in the service process with service account privileges. It requires non-default configuration: event scripting enabled, JScript as script language, and an OnClientValidatePassword handler defined. Exploitation uses a password with backslash and apostrophe that is not properly escaped.
- CVE-2026-100721Critical
A vulnerability in vm2 before 3.12.2 allows an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver and `context: 'host'`, guest code can require an allowlisted module and then an absolute path of a non-allowlisted sibling sharing the resolved prefix. This leads to a sandbox escape and arbitrary code execution in the host process.
- CVE-2026-100740Critical
A vulnerability in D-Link DIR-895L A1_102b07 affects the tunnel_set_params function in tunnel.c of the L2TP Control Channel Parser component. Manipulation results in an out-of-bounds write. The attack can be initiated remotely, and the exploit is now public.
- CVE-2026-82901Critical
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: This is only exploitable when the plugin's PDF Generator module is enabled, which is disabled by default.
- CVE-2026-85984Critical
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log in as any existing administrator account by supplying only a known username and an empty password alongside mo_wp_login_intent=otp, with no password or OTP verification required. Exploitation is conditional on a site administrator having simultaneously enabled the following plugin options: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass.
- CVE-2026-97163Critical
The Joomla UP plugin extension (lomart.fr) in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains an unauthenticated remote code installation vulnerability. An attacker without authentication can cause malicious code to be installed in the application.
- CVE-2026-97161Critical
The Joomla UP plugin extension (lomart.fr) in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains various path traversal and file access vectors. An attacker can access files outside the intended directory.
Original NVD description (English source)
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS