CVE-2020-1464KEV · OVERDUE

Windows Spoofing Vulnerability

High · published August 17, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 98.6th percentile for exploit probability.

1634
days past CISA
deadline
CVSS v3.1
7.8
EPSS
39%
Percentile
98.6
In the wild
Confirmed
What it is

🚨 Windows is letting in the bad guys! A sneaky spoofing vulnerability means attackers can bypass security features and load files that should be off-limits. 🔥 Think of it as a bouncer at an exclusive club who doesn’t check IDs properly. An attacker could waltz right in with a fake pass, slipping through security and causing chaos on the dance floor! If exploited, this vulnerability could allow attackers to run malicious software on your system, bypassing all the safeguards designed to keep your computer safe. This could lead to data breaches, system compromises, or even an outright takeover of your machine—absolutely devastating!

Put simply

Think of it as a bouncer at an exclusive club who doesn’t check IDs properly. An attacker could waltz right in with a fake pass, slipping through security and causing chaos on the dance floor! This spoofing vulnerability stems from Windows' incorrect validation of file signatures, enabling attackers to load improperly signed files without triggering security alerts.

What to do

If exploited, this vulnerability could allow attackers to run malicious software on your system, bypassing all the safeguards designed to keep your computer safe. This could lead to data breaches, system compromises, or even an outright takeover of your machine—absolutely devastating! To protect your system, patch Windows immediately by updating to the latest version that addresses this vulnerability. Regularly check for system updates and ensure your security settings are properly configured to prevent unauthorized file access. You’ve got this! Stay vigilant, follow these steps, and you'll keep those pesky attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.38946 · 98.6th percentile
Published
2020-08-17T19:13Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 17 AUG 19:13Z
    Windows Spoofing Vulnerability
    cvelistv5