Microsoft Patch Tuesday — January 2020

Exploited 3

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

• Critical 9.8
  CVE-2020-0646 Exploited Public exploit A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Inje…
  EPSS 99%
• High 8.1
  CVE-2020-0601 Exploited Public exploit Certificate validation bypass on Windows in crypto/x509
  EPSS 89%
• High 7.8
  CVE-2020-0638 Exploited An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first …
  EPSS 2.5%

All vulnerabilities 49