What happened?
On 17 January 2020, Microsoft took a step it reserves for genuinely uncomfortable situations: it published an advisory for a vulnerability it could not yet fix. CVE-2020-0674 was a remote code execution flaw in the scripting engine that powers Internet Explorer 9 and 11, and Microsoft stated plainly that it was aware of limited targeted attacks exploiting it. No patch existed. The guidance was mitigation and workaround – or stop using IE entirely. For nearly a month, until the 11 February 2020 cumulative update shipped, every defender running legacy browser estates carried an unfixed memory-corruption bug that adversaries were already using. ADV200001 became the first draft of 2020’s defining lesson: the space between disclosure and patch belongs to the attacker.
Quick Answer: CVE-2020-0674 is a remote code execution vulnerability in the jscript engine used by Internet Explorer 9 and 11, disclosed by Microsoft advisory ADV200001 on 17 January 2020 with confirmation of limited targeted exploitation and no patch yet available. Viewing a malicious web page or opening a crafted document that invoked the IE rendering engine could corrupt memory and run attacker code at the current user’s privileges. Mitigations included restricting jscript.dll and disabling IE use; the definitive fix shipped in the 11 February 2020 cumulative update.
The details located the fault precisely. The Script Engine, implemented in jscript.dll, corrupted memory when processing crafted web content in an unspecified function. Internet Explorer 9 and 11 were the affected surfaces. To exploit, an attacker needed the target to load hostile scripting – typically by visiting a malicious site, or by opening an Office document that hosted the IE engine in a preview pane or embedded object. Successful exploitation meant code running with the logged-in user’s rights, which on countless corporate fleets meant domain-user rights, which meant the adjacent network, shared drives, and every credential in the session. In 2020, that launchpad description applied to an enormous installed base that had never migrated off IE for legacy web-app reasons.
The advisory that had no patch
Microsoft’s standard rhythm ties disclosure to a fix. ADV200001 broke the rhythm deliberately, and the reason was in one sentence: limited targeted attacks. When exploitation is already occurring, sitting silently serves victims poorly, vendors judge, so the company described the flaw, credited Qihoo 360 with reporting it, and shipped an archive of mitigations. The option list told its own story about IE’s era. Restricting access to jscript.dll required registry edits with companion disclaimers about breaking functionality. The extended mitigation was absurdly simple and telling: use Microsoft Edge or another modern browser, since the flaw was in IE’s engine. For enterprises whose line-of-business applications required IE, that advice was functionally decorative, and those enterprises were the exact population targeted attacks favor.
The paper trail
| Date | Event |
|---|---|
| 2020-01-17 | Microsoft publishes ADV200001 describing CVE-2020-0674, IE 9/11 remote code execution, exploited in limited targeted attacks, no patch yet |
| 2020-01-17 | Mitigations published: restrict jscript.dll per the advisory’s registry guidance, or avoid Internet Explorer for untrusted sites |
| 2020-02-11 | February cumulative updates ship the fix for CVE-2020-0674, closing the 25-day unpatched window |
| 2020-02-12 | Post-patch guidance folds hunting into normal operations: verify update rollout, review IE usage logs for suspicious hosts |
Why IE still mattered in 2020
The browser Microsoft wanted dead remained load-bearing across entire industries. Health care ran patient portals built for IE’s quirks. Manufacturing lines executed interfaces written in the era of ActiveX. Government intranets, banking back offices, and logistics dashboards everywhere held the installed base hostage to compatibility, and the installed base held IT security hostage to the exposure. The scribbling on every one of those support contracts had a technical translation: we cannot patch the browser usage pattern, only the browser. That is how a scripting-engine memory bug in 2020 still mapped to enterprise-defining risk, and why the advisory’s workaround section read like a tax form for an audience with no exemptions left. Every later migration program – Edge’s IE mode, virtualized legacy zones, sunsetting contracts with vendors requiring IE – traces ancestry to winters like January 2020.
Targeted attacks, meaningfully different
Limited targeted attacks is a phrase worth pausing on, because it differs from both mass exploitation and mere proof-of-concept publication. It means the vendor has observed the flaw being used against specific victims, typically via emails, watering holes, or purchased access, rather than sprayed across the internet. Targeted usage changes defender math. Mass exploitation punishes any unpatched presence; targeted exploitation punishes the specifically interesting – journalists, dissidents, defense-adjacent firms, and the contractors around them. The defending population therefore splits: everyone should patch on schedule, but the interesting minority must additionally hunt for signs of prior use, because the patch closes the door without evicting anyone who walked through it earlier. ADV200001’s language gestured at exactly this, which is why its guidance included not just mitigation but vigilance.
The 25-day window in practice
Between 17 January and 11 February 2020, security teams ran the oldest play in the book with the newest entry point. Application allowlisting coverage moved from nice-to-have to urgent for hosts that could not avoid IE. Proxy logs gained queries for hosts visiting domains whose pages would plausibly deliver the exploit. Heightened monitoring concentrated on the highest-value users, those with administrative rights or executive access, because the exploit’s ceiling was user privileges and user privileges were asymmetric across the fleet. Then the 11 February cumulative update landed, and the window closed – for the patched. The unpatched overhang, as with every client-side flaw, extended indefinitely across consumer machines and forgotten servers, and scanning for vulnerable configurations continued long after the story left the news cycle.
- Workarounds are real defenses: registry restrictions and usage policies measurably reduced exposure during the unpatched month; incident response that dismisses mitigations as theater leaves a vacuum attackers fill.
- Legacy dependencies are standing debt: every application locked to IE converted a browser flaw into enterprise risk; the debt was called in January 2020 and would be called again.
- Targeted changes the denominator: patch-everything remains correct, but high-value assets need assume-prior-exposure thinking, not just forward-looking fixes.
- Advisories without patches are trust tests: Microsoft chose transparency over tactical silence; the practice has since become the sector’s expected norm for in-the-wild bugs awaiting fixes.
FAQ
What was CVE-2020-0674?
A remote code execution vulnerability in the jscript scripting engine used by Internet Explorer 9 and 11. Crafted web content processed by the engine could corrupt memory and execute attacker code with the privileges of the logged-in user. Microsoft disclosed it on 17 January 2020 via advisory ADV200001, stating it was being exploited in limited targeted attacks.
Why was there no patch at disclosure?
The flaw was reported and attacks were already underway while fix engineering and release timing were being finalized. Rather than hold the information, Microsoft published the advisory with mitigations and workarounds, then shipped the definitive fix in the 11 February 2020 cumulative updates. The gap created a roughly 25-day period where defense meant configuration, not patching.
How would an attack have worked?
A victim would load hostile scripting into the IE engine – by browsing to a malicious page engineered for the target, or opening a document or email preview that invoked IE rendering. The crafting corrupts memory inside jscript.dll, hands execution to attacker-supplied shellcode, and the code inherits the user’s rights. From there, credential theft and lateral movement follow standard tradecraft, which is why user-privilege RCE remains a serious class despite not being SYSTEM-level.
Who reported the bug?
Microsoft’s advisory credited Qihoo 360 with reporting the vulnerability. The disclosure-with-mitigations pattern, vendor plus researcher coordination, with an explicit statement on active exploitation, became a template for subsequent zero-day advisories across the industry.
What ended the risk?
The 11 February 2020 cumulative update for affected Windows versions. Organizations then faced the usual adoption tail: verifying rollout completeness, hunting logs for pre-patch exploitation among high-value hosts, and accelerating the legacy-browser migrations that January had made newly urgent. IE’s formal retirement came years later, but the managed decline began in windows like this one.
Legacy: the month the workaround mattered
CVE-2020-0674 occupies a modest but strategic place in the 2020 story arc. It demonstrated that the advisory-plus-mitigation format works: disclosure with honest exploitation language, actionable hardening for the gap period, and a clean fix on the next release vehicle. It exposed the true scale of IE dependency across industries that had publicly moved on and privately had not. And it previewed the year’s rhythm – client-side engines, targeted usage, and the patch clock always running. For the teams that lived through the January window, the takeaway was procedural and durable: maintain the ability to restrict dangerous components at scale, know which of your users are interesting, and treat every legacy dependency as a borrowing against a future incident you did not choose. The scripting engine got patched; the institutional lessons, like the workarounds, were written to last.
