Windows Spoofing Vulnerability (CVE-2020-1464)

What is affected, what to do

A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft Windows 10 Version 1803 gte 10.0.0..*
• Microsoft Windows 10 Version 1809 gte 10.0.0..*
• Microsoft Windows Server 2019 gte 10.0.0..*
• Microsoft Windows Server 2019 (Server Core installation) gte 10.0.0..*
• Microsoft Windows 10 Version 1909 gte 10.0.0..*
• Microsoft Windows Server, version 1909 (Server Core installation) gte 10.0.0..*
• Microsoft Windows 10 Version 1709 for 32-bit Systems gte 10.0.0..*
• Microsoft Windows 10 Version 1709 gte 10.0.0..*
• Microsoft Windows 10 Version 1903 for 32-bit Systems gte 10.0.0..*
• Microsoft Windows 10 Version 1903 for x64-based Systems gte 10.0.0..*
• Microsoft Windows 10 Version 1903 for ARM64-based Systems gte 10.0.0..*
• Microsoft Windows Server, version 1903 (Server Core installation) gte 10.0.0..*
• Microsoft Windows 10 Version 2004 gte 10.0.0..*
• Microsoft Windows Server version 2004 gte 10.0.0..*
• Microsoft Windows 10 Version 1507 gte 10.0.0..*
• Microsoft Windows 10 Version 1607 gte 10.0.0..*
• Microsoft Windows Server 2016 gte 10.0.0..*
• Microsoft Windows Server 2016 (Server Core installation) gte 10.0.0..*
• Microsoft Windows 7 gte 6.1.0..*
• Microsoft Windows 7 Service Pack 1 gte 6.1.0..*
• Microsoft Windows 8.1 gte 6.3.0..*
• Microsoft Windows Server 2008 Service Pack 2 gte 6.0.0..*
• Microsoft Windows Server 2008 Service Pack 2 (Server Core installation) gte 6.0.0..*
• Microsoft Windows Server 2008 R2 Service Pack 1 gte 6.1.0..*
• Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation) gte 6.0.0..*
• Microsoft Windows Server 2012 gte 6.2.0..*
• Microsoft Windows Server 2012 (Server Core installation) gte 6.2.0..*
• Microsoft Windows Server 2012 R2 gte 6.3.0..*
• Microsoft Windows Server 2012 R2 (Server Core installation) gte 6.3.0..*

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Verify and deploy the security update: Microsoft fixed the signature validation for CVE-2020-1464 in its August 2020 update cycle. The patch is available from the vendor; look up the KB number for each Windows build in the Microsoft Security Update Guide. Use WSUS/Intune/SCCM compliance reports to find every client whose cumulative update predates August 2020.
   • Isolate unsupported Windows 10 builds: Affected versions 1507, 1709, 1803 and 1809 are partly out of support. Move these hosts to a quarantine VLAN and prioritise migrating them to a supported build with a current cumulative update. Any unpatched host points to a wider patch-management gap.
   • Review signature-based trust: On unpatched hosts, treat as untrusted any AppLocker, WDAC, EDR exclusion or proxy rule that trusts a file solely because it has a valid Authenticode signature. This applies especially to signed .msi files.
   • Hunt for tampered files: Sweep download, temp and mail-attachment directories for files that carry an MSI/CFB header (D0 CF 11 E0) but use a .jar, .hta or .js extension, or that contain appended ZIP data (PK\x03\x04). This matches the known "GlueBall" technique.
   • Stop .jar double-click execution: Where the Java runtime has no business use, remove the .jar → javaw.exe file association.
2. 02

   Runbook step 2

   Mitigation layers

   • Application control (WDAC/AppLocker): Allow javaw.exe and java.exe only for defined line-of-business apps. Block mshta.exe, wscript.exe and cscript.exe for standard users. While hosts remain unpatched, base rules on file hashes rather than publisher alone.
   • Mail and web gateway: Block or quarantine .jar, .hta and .msi files, both as direct attachments and inside archives. Add a content-inspection rule that flags files with a CFB magic number and an embedded ZIP local-file header, regardless of extension. This catches polyglot files.
   • Endpoint hardening: Enable the Microsoft Defender ASR rule "Block executable files from running unless they meet a prevalence, age, or trusted list criterion". Also enable "Block JavaScript or VBScript from launching downloaded executable content".
   • Complementary configuration: Set the EnableCertPaddingCheck registry value according to Microsoft's CVE-2013-3900 guidance, which tightens checks on data appended to signed PE files. This adds defence in depth but does not replace the patch.
   • Least privilege: Remove local admin rights and restrict MSI installation to software-distribution accounts. Make sure the AlwaysInstallElevated policy is disabled.
3. 03

   Runbook step 3

   Detection rules

   • Sysmon EID 1 / Security 4688 – Java launching a non-JAR container: Look for javaw.exe or java.exe running -jar against a path in \Downloads\, \AppData\Local\Temp\ or \Content.Outlook\. As a KQL query: DeviceProcessEvents | where FileName in~ ("javaw.exe","java.exe") and ProcessCommandLine has_any ("\\Downloads\\","\\Temp\\","Content.Outlook").
   • Sysmon EID 11 / EDR file events – polyglot file: Run a YARA rule against newly written files: uint32(0) == 0xE011CFD0 and $pk at > 512, with $pk = { 50 4B 03 04 }. Treat any hit whose extension is not .msi as high-confidence.
   • Process ancestry: A chain of explorer.exe → javaw.exe → cmd.exe/powershell.exe suggests an executed payload. So does mshta.exe taking an .msi file as an argument. A Sigma rule can express this as ParentImage|endswith: '\javaw.exe' AND Image|endswith: ['\cmd.exe','\powershell.exe'].
   • AppLocker/WDAC logs: Review AppLocker EID 8003/8004 and CodeIntegrity EID 3033/3077 for blocked execution attempts from user-writable paths.
   • Network telemetry (Zeek/Suricata): Watch for HTTP downloads of Java archives or MSI files where the extension does not match the magic bytes. A Zeek files.log entry with mime_type=application/x-ole-storage and a filename ending in .jar is a strong indicator.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files. In an attack scenario, an attacker could bypass security features intended to prevent improperly signed files from being loaded. The update addresses the vulnerability by correcting how Windows validates file signatures.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Microsoft Windows 10 1507
• Microsoft Microsoft Windows 10 1607
• Microsoft Windows 10 1709
• Microsoft Windows 10 1803
• Microsoft Microsoft Windows 10 1809
• Microsoft Windows 10 1903
• Microsoft Windows 10 1909
• Microsoft Windows 10 2004
• Microsoft Windows 10 Version 1507
• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1709
• Microsoft Windows 10 Version 1709 For 32-bit Systems

Weakness classes (CWE)

• CWE-347Improper Verification of Cryptographic Signature

  Base

  The product does not verify, or incorrectly verifies, the cryptographic signature for data.

  Entry at MITRE CWE-347

References & sources

• medium.com@TalBeerySec/glueball-the-story-of-cve-2020-1464-50091a1f98bdx_refsource_MISC, Exploit, Third-party advisory
• krebsonsecurity.com2020/08/microsoft-put-off-fixing-zero-day-for-2-yearsx_refsource_MISC, Issue tracking, Third-party advisory
• portal.msrc.microsoft.comen-US/security-guidance/advisory/CVE-2020-1464x_refsource_MISC, Patch, Vendor advisory
• blog.virustotal.com2019/01/distribution-of-malicious-jar-appended.htmlx_refsource_MISC, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1464government-resource, US government resource