CVE-2020-1464

HighActively exploited (CISA KEV)

Description

A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files. In an attack scenario, an attacker could bypass security features intended to prevent improperly signed files from being loaded. The update addresses the vulnerability by correcting how Windows validates file signatures.

SeverityHigh
CVSS7.8
Exploit probability—
ProductMicrosoft Windows
PublishedAug 17, 2020
First seenAug 17, 2020
Added to KEVNov 3, 2021
Weakness typeCWE-347CWE-347

How to fix

CISA required action

Apply updates per vendor instructions.

CISA due date: May 3, 2022

Affected products

ProductAffected versionsFixed in
microsoft windows_10_1507No range specified—
microsoft windows_10_1607No range specified—
microsoft windows_10_1709No range specified—
microsoft windows_10_1803No range specified—
microsoft windows_10_1809No range specified—
microsoft windows_10_1903No range specified—
microsoft windows_10_1909No range specified—
microsoft windows_10_2004No range specified—
microsoft windows_7No range specified—
microsoft windows_8.1No range specified—
microsoft windows_rt_8.1No range specified—
microsoft windows_server_1903No range specified—
microsoft windows_server_1909No range specified—
microsoft windows_server_2004No range specified—
microsoft windows_server_2008No range specified, r2—
microsoft windows_server_2012No range specified, r2—
microsoft windows_server_2016No range specified—
microsoft windows_server_2019No range specified—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.