Security CISA KEV CVE-2020-0601 CVE-2020-0601 CISA KEV
Microsoft Windows CryptoAPI Spoofing Vulnerability
Severity unknown CVSS unknown Check the vendor advisory for fixed versions
CISA lists this Microsoft vulnerability as known exploited. Its MSRC release detail is outside this installation's collected history.
Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected softw…
Product Windows
Added to KEV 3 Nov 2021
Federal remediation due 3 May 2022
Known ransomware use Not reported
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
Cite this version Field-level log (2)
Up to 100 recent field edits are shown; older edits may be outside retention.
23 Oct 2026 · 09:33:49 UTC
Source coverage: cisa-kev Incomplete → Current 23 Oct 2026 · 08:31:50 UTC
Source coverage: cisa-kev Current → Incomplete Explore global source statements, affected packages and advisory history for CVE-2020-0601 . The catalog has a separate collection scope from Microsoft release records.
More advisories, affected versions and source history
cve-program · CVE-2020-0601 Published Windows Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"product": "Windows",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "10 Version 1803 for 32-bit Systems"
},
{
"status": "affected",
"version": "10 Version 1803 for x64-based Systems"
},
{
"status": "affected",
"version": "10 Version 1803 for ARM64-based Systems"
},
{
"status": "affected",
"version": "10 Version 1809 for 32-bit Systems"
},
{
"status": "affected",
"version": "10 Version 1809 for x64-based Systems"
},
{
"status": "affected",
"version": "10 Version 1809 for ARM64-based Systems"
},
{
"status": "affected",
"version": "10 Version 1709 for 32-bit Systems"
},
{
"status": "affected",
"version": "10 Version 1709 for x64-based Systems"
},
{
"status": "affected",
"version": "10 Version 1709 for ARM64-based Systems"
},
{
"status": "affected",
"version": "10 for 32-bit Systems"
},
{
"status": "affected",
"version": "10 for x64-based Systems"
},
{
"status": "affected",
"version": "10 Version 1607 for 32-bit Systems"
},
{
"status": "affected",
"version": "10 Version 1607 for x64-based Systems"
}
]
} Windows Server Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"product": "Windows Server",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "version 1803 (Core Installation)"
},
{
"status": "affected",
"version": "2019"
},
{
"status": "affected",
"version": "2019 (Core installation)"
},
{
"status": "affected",
"version": "2016"
},
{
"status": "affected",
"version": "2016 (Core installation)"
}
]
} Windows 10 Version 1903 for 32-bit Systems Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"product": "Windows 10 Version 1903 for 32-bit Systems",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
} Windows 10 Version 1903 for x64-based Systems Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"product": "Windows 10 Version 1903 for x64-based Systems",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
} Windows 10 Version 1903 for ARM64-based Systems Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"product": "Windows 10 Version 1903 for ARM64-based Systems",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
} Windows Server, version 1903 (Server Core installation) Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"product": "Windows Server, version 1903 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
} Windows 10 Version 1909 for 32-bit Systems Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"product": "Windows 10 Version 1909 for 32-bit Systems",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
} Windows 10 Version 1909 for x64-based Systems Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"product": "Windows 10 Version 1909 for x64-based Systems",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
} Windows Server, version 1909 (Server Core installation) Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"product": "Windows Server, version 1909 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
} Windows 10 Version 1909 for ARM64-based Systems Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"product": "Windows 10 Version 1909 for ARM64-based Systems",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
} Original source record · Cite this exact observation · Complete original publisher JSON
euvd · EUVD-2020-2099 Published EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields datePublished: Jan 14, 2020, 11:11:20 PM
dateUpdated: Oct 21, 2025, 11:35:53 PM
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON
nvd · CVE-2020-0601 Published NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Analyzed
Weakness classifications: CWE-295
Original publisher date fields published: 2020-01-14T23:15:30.207
lastModified: 2026-06-17T02:46:08.127
26 source CPE criteria · context only cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:* cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:* cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:arm64:* cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:* cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:arm64:* cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:* cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:* cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:* cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:x86:* cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:arm64:* cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:x86:* cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_1903:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_1909:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* The original JSON retains the logical configuration operators, exclusions and version bounds.
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON