Security News > 2020 > April > SMBGhost Vulnerability Allows Privilege Escalation on Windows Systems
Researchers have published proof-of-concept exploits to demonstrate that the Windows vulnerability tracked as SMBGhost and CVE-2020-0796 can be exploited for local privilege escalation.
The critical flaw, described as "Wormable" and related to the way SMB 3.1.1 handles certain requests, affects Windows 10 and Windows Server versions 1903 and 1909.
A PoC for remote code execution has yet to be made public, but cybersecurity firm ZecOps has developed and released a PoC that shows how SMBGhost can be exploited to escalate privileges to SYSTEM. Researchers Daniel García Gutiérrez and Manuel Blanco Parajón have also made available a PoC that exploits SMBGhost to escalate privileges to SYSTEM. ZecOps has also published a blog post with the technical details for local privilege escalation.
A scan conducted by cybersecurity company Kryptos Logic shortly after CVE-2020-0796 was disclosed revealed the existence of roughly 48,000 servers vulnerable to SMBGhost attacks.
Windows users can protect themselves against potential attacks by applying workarounds and mitigations shared by Microsoft or by installing the official patches.
News URL
Related news
- Microsoft Patches 125 Flaws Including Actively Exploited Windows CLFS Vulnerability (source)
- PipeMagic Trojan Exploits Windows Zero-Day Vulnerability to Deploy Ransomware (source)
- WhatsApp vulnerability could be used to infect Windows users with malware (CVE-2025-30401) (source)
- Microsoft: Windows CLFS Vulnerability Could Lead to ‘Widespread Deployment and Detonation of Ransomware’ (source)
- Windows NTLM vulnerability exploited in multiple attack campaigns (CVE-2025-24054) (source)
- ThreatLocker Patch Management: A Security-First Approach to Closing Vulnerability Windows (source)
- Critical Windows Server 2025 dMSA Vulnerability Enables Active Directory Compromise (source)
- Unpatched Windows Server vulnerability allows full domain compromise (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-03-12 | CVE-2020-0796 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Microsoft products A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'. | 10.0 |