CVE-2020-17095: 
vulnerability analysis and mitigation

Windows Hyper-V Remote Code Execution Vulnerability (CVE-2020-17095) was identified and disclosed in December 2020. The vulnerability affects multiple versions of Microsoft Windows 10 (1607, 1803, 1809, 1903, 1909, 2004, 20H2) and Windows Server (2016, 2019) operating systems running Hyper-V (NVD).

The vulnerability has received a CVSS v3.1 base score of 9.9 (Critical) from NIST and 8.5 (High) from Microsoft. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating network accessibility, low attack complexity, low privileges required, no user interaction needed, and high impact on confidentiality, integrity, and availability (NVD).

This vulnerability could allow an attacker to execute arbitrary code on affected systems through Hyper-V, potentially compromising the confidentiality, integrity, and availability of the system. The critical severity rating indicates the potential for significant impact if successfully exploited (NVD).

The vulnerability requires network access and low privileges for exploitation. The attack complexity is considered low according to the CVSS metrics, making it relatively straightforward to exploit once the necessary access is obtained (NVD).

Microsoft has released security updates to address this vulnerability. The fixes are available through various KB updates including KB4593226 for Windows 10 version 1607, KB4592446 for version 1803, KB4592440 for version 1809, KB4592449 for versions 1903 and 1909, and KB4592438 for versions 2004 and 20H2 (Rapid7).