Microsoft used its first Patch Tuesday update of the new decade to address a critical vulnerability in its CryptoAPI library.

A default feature within Windows that’s also known as Crypt32.dll, the CryptoAPI patch addresses a bug that could allow rogue actors to fake signatures on encrypted HTTPS communications and launch man-in-the-middle (MitM) attacks. By spoofing Elliptic Curve Cryptography (ECC) certificates, hackers could also make malicious files appear like they were coming from a legitimate source.

The U.S. National Security Agency (NSA) first discovered and informed Microsoft about the vulnerability, the company said.

‘Severe And Widespread’ Risks

Though neither organization has reported any cyberattacks that make use of the bug, CVE-2020-0601, it affects several Windows operating systems. These include Windows 10, Windows Server 2016 and Windows Server 2019.

In its advisory, the NSA said the CryptoAPI vulnerability could lead to remote code execution and the ability to defeat trusted network connections. It also predicted cybercriminals would quickly recognize the opportunity in front of them.

“Remote exploitation tools will likely be made quickly and widely available,” it said, adding that the consequences of not patching CVE-2020-0601 could be “severe and widespread.”

In an interview with security researcher Brian Krebs, Matthew Green, a computer science professor from Johns Hopkins University, said cybercriminals could be creative in their use of the Crypt32 flaw. Users might be fooled into downloading malware disguised as software updates, for instance, or clicking on a website that appears trustworthy.

Besides the CryptoAPI/Crypt32 vulnerability, Microsoft’s Patch Tuesday update dealt with 49 other security gaps in Windows and related applications. It was also a significant milestone in that the update officially ended mainstream support for Windows 7.

Apply Patches to Maintain a Solid Security Posture

While the NSA’s advisory will probably lead organizations to prioritize the CryptoAPI patch, the IT security best practice approach is to patch early, often and extensively. In other words, all the necessary patches should be applied.

Security experts have noted that issues like technical debt and “patch fatigue” can sometimes prevent this from happening. Overcome that by making sure your patch management tools are up to date and by conducting a vulnerability assessment to make sure nothing is overlooked.