IRONSMITHINTEL
HIGHCVSS8.1
|
Actively Exploited
|CISA KEV|CVE-2020-0601|Auth: none — unauthenticated|Reboot: required|Manual only

KB4528760: Windows Server Security Update (January 2020)

Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.

Published Jan 14, 2020 · Updated May 16, 2026
Why patchRisk explained in plain English
Worst-case scenarioIf unpatched

A remote attacker, without authentication, can achieve full data confidentiality loss, arbitrary modification of data. Federal agencies are required to remediate by 2022-05-03 under CISA BOD 22-01.

How the attack worksNo clicks needed

This is a Improper Certificate Validation (CWE-295) vulnerability in Microsoft Windows. A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'. Exploitation requires remote network access, low attack complexity, no authentication required, and user interaction required.

📧

Phishing link

→

🖼

Malicious file

🔓

Server compromised

Am I affected?Quick check

Probably yes if any of these apply:

●Windows Administrators
●Systems Engineers
●IT Security
●Running windows 10 1507: -; windows 10 1607: -; windows 10 1709: -; windows 10 1803: -; windows 10 1903: -; windows 10 1909: -; windows server 1803: -; windows server 1903: -; windows server 1909: -; windows server 2016: -; windows server 2019: -; go: 1.12 ≤ v < 1.12.16, 1.13 ≤ v < 1.13.7
Fixed inKB4528760, KB4534271, KB4534273, KB4534276, KB4534293, KB4534306 (applies to 26 product versions)
Real-world incidentsWhat we've seen

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2021-11-03 based on evidence of active exploitation in the wild. Federal agencies required to remediate by 2022-05-03.

How to patch

Manual download

For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.

↗ Microsoft Update CatalogKB4528760

Manual remediation steps

Apply the Microsoft Security Update

Microsoft has released an official security update that fixes this vulnerability.

Required KB Updates

    1
    KB4528760 — https://support.microsoft.com/help/4528760
    1
    KB4534271 — https://support.microsoft.com/help/4534271
    1
    KB4534273 — https://support.microsoft.com/help/4534273
    1
    KB4534276 — https://support.microsoft.com/help/4534276
    1
    KB4534293 — https://support.microsoft.com/help/4534293
    1
    KB4534306 — https://support.microsoft.com/help/4534306

Supersedes: KB4530681, KB4530684, KB4530689, KB4530714, KB4530715, KB4530717

Affected Products

    1
    Windows 10 Version 1607 for 32-bit Systems
    1
    Windows 10 Version 1607 for x64-based Systems
    1
    Windows 10 Version 1709 for 32-bit Systems
    1
    Windows 10 Version 1709 for ARM64-based Systems
    1
    Windows 10 Version 1709 for x64-based Systems
    1
    Windows 10 Version 1803 for 32-bit Systems
    1
    Windows 10 Version 1803 for ARM64-based Systems
    1
    Windows 10 Version 1803 for x64-based Systems
    1
    Windows 10 Version 1809 for 32-bit Systems
    1
    Windows 10 Version 1809 for ARM64-based Systems
    1
    Windows 10 Version 1809 for x64-based Systems
    1
    Windows 10 Version 1903 for 32-bit Systems
    1
    Windows 10 Version 1903 for ARM64-based Systems
    1
    Windows 10 Version 1903 for x64-based Systems
    1
    Windows 10 Version 1909 for 32-bit Systems
    1
    Windows 10 Version 1909 for ARM64-based Systems
    1
    Windows 10 Version 1909 for x64-based Systems
    1
    Windows 10 for 32-bit Systems
    1
    Windows 10 for x64-based Systems
    1
    Windows Server 2016
    1
    (…6 more product versions)

Installation Methods

Windows Update (recommended)

1
Settings → Windows Update → Check for updates
2
The security update is offered if your system is in scope
3
Restart when prompted — a reboot IS required to complete the install

Microsoft Update Catalog (manual download)

1
Open https://catalog.update.microsoft.com
2
Search for KB4528760
3
Download the package matching your OS architecture and Windows build
4
Run the .msu installer with administrator privileges
5
Restart when prompted

WSUS / SCCM / Intune

Approve KB4528760 for the affected products in your update management console.

Microsoft Download Center Links

    1
    https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4528760
    1
    https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4534271
    1
    https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4534273
    1
    https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4534276
    1
    https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4534293
    1
    (…1 more)

Verification

Confirm the update is installed:

Get-HotFix | Where-Object { $_.HotFixID -in @('KB4528760','KB4534271','KB4534273','KB4534276','KB4534293','KB4534306') }

References

    1
    Microsoft Security Response Center: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601
    1
    KB article: https://support.microsoft.com/help/4534271
    1
    KB article: https://support.microsoft.com/help/4534273
    1
    KB article: https://support.microsoft.com/help/4534276
    1
    NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2020-0601
    1
    CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0601

Discovery Credit

National Security Agency

PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

References

↗ CVE-2020-0601↗ MSRC Advisory↗ NVD↗ KBKB4528760