Microsoft Windows Spoofing

What to do

1. Update Windows 10 Version 1803 to publication or a later version.
2. Update Windows 10 Version 1809 to publication or a later version.
3. Update Windows Server 2019 to publication or a later version.
4. CISA's required action: Apply updates per vendor instructions.
5. Read the advisory on portal.msrc.microsoft.com for workarounds and exact fixed builds.

Affected products and versions

Version data comes from the organisation that assigned the CVE; 17 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector

LocalThe attacker needs local access or must trick a user into running something.

Attack complexity

LowNo special conditions are needed; the attack works reliably.

Privileges required

LowA basic user account is enough.

User interaction

NoneNo action by a victim is required.

Scope

UnchangedImpact stays within the vulnerable component.

Confidentiality

NoneNo data is disclosed.

Integrity

HighData or code can be modified at will.

Availability

NoneAvailability is not affected.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. Scored by NVD.

Official description

A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files. In an attack scenario, an attacker could bypass security features intended to prevent improperly signed files from being loaded. The update addresses the vulnerability by correcting how Windows validates file signatures.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Verification of Cryptographic Signature

Timeline

1. August 17, 2020CVE record published.
2. November 3, 2021Added to CISA's Known Exploited Vulnerabilities catalogue.
3. May 3, 2022Deadline for US federal agencies to remediate, set by CISA.
4. February 4, 2025CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
5. June 17, 2026Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Windows 10 Version 1803

• 7.8 High severity

  Microsoft Win32k Privilege Escalation Exploited

  CVE-2021-28310Apr 13, 2021MicrosoftEPSS 8.4%
• 7.8 High severity

  Microsoft Win32k Privilege Escalation Exploited

  CVE-2021-1732Feb 25, 2021MicrosoftEPSS 78.4%
• 7.8 High severity

  Microsoft Windows Kernel Privilege Escalation Exploited

  CVE-2020-17087Nov 11, 2020MicrosoftEPSS 5.43%
• 7.8 High severity

  Microsoft Win32k Privilege Escalation Exploited

  CVE-2020-1054May 21, 2020MicrosoftEPSS 53.9%
• 7.8 High severity

  Microsoft Task Scheduler Privilege Escalation Exploited

  CVE-2019-1069Jun 12, 2019MicrosoftEPSS 6.17%
• 7.8 High severity

  Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Exploited

  CVE-2019-1064Jun 12, 2019MicrosoftEPSS 6.89%

Recent Improper Verification of Cryptographic Signature vulnerabilities

• 10.0 Critical severity

  Palo Alto Networks PAN-OS Authentication Bypass Exploited

  CVE-2020-2021Jun 29, 2020Palo Alto NetworksEPSS 4.36%
• 8.8 High severity

  Microsoft WinVerifyTrust function Remote Code Execution Exploited

  CVE-2013-3900Dec 11, 2013MicrosoftEPSS 44.6%

Spotted an error? Tell us.