# CVE-2020-0785 — Microsoft Windows

> As of 2024-08-04, CVE-2020-0785 is a vulnerability in Microsoft Windows, EPSS 0.7% (52.3th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2020-0785, most recently “LegacyHive: Unpatched Windows User Profile Service (profsvc) Registry Hive Hijack Privilege Escalation 0-Day PoC Released by Nightmare-Eclipse”.

**Last updated:** 2024-08-04

## What is CVE-2020-0785?

An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows User Profile Service Elevation of Privilege Vulnerability'.

10 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 2421 days ago.

## Severity and exploitation probability

- **EPSS (FIRST):** 0.7% probability of exploitation in the next 30 days, higher than 52.3% of all scored CVEs
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Threadlinqs priority:** 2.1/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- **Published:** 2020-03-12, last modified 2024-08-04

## Is CVE-2020-0785 being exploited?

It currently carries a trending score of 18 in the Threadlinqs vulnerability feed.

## Affected products and versions

- [Microsoft](https://intel.threadlinqs.com/vendors/microsoft): Windows, Windows Server, Windows 10 Version 1909 for 32-bit Systems, Windows 10 Version 1909 for x64-based Systems, Windows 10 Version 1909 for ARM64-based Systems, Windows Server, version 1909 (Server Core installation), Windows 10 Version 1903 for 32-bit Systems, Windows 10 Version 1903 for x64-based Systems, Windows 10 Version 1903 for ARM64-based Systems, Windows Server, version 1903 (Server Core installation)

## How to fix CVE-2020-0785

No vendor patch reference has been recorded for CVE-2020-0785 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2020-0785

1 tracked threat in the Threadlinqs corpus references CVE-2020-0785, either in the campaign’s CVE list or as an indicator on the campaign record.

- [LegacyHive: Unpatched Windows User Profile Service (profsvc) Registry Hive Hijack Privilege Escalation 0-Day PoC Released by Nightmare-Eclipse](https://intel.threadlinqs.com/threat/TL-2026-1373) — HIGH · 2026-07-15

## Sources

Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories. Last verified by Threadlinqs on 2026-10-10.

**Other references**

- [portal.msrc.microsoft.com](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0785)

Canonical: https://intel.threadlinqs.com/cve/CVE-2020-0785
Full detection coverage and IOCs for threats exploiting CVE-2020-0785 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp