Microsoft today patched an extremely serious vulnerability discovered by the National Security Agency that affects Windows 10, which is the most widely used operating system in enterprises and government.

In its first Patch Tuesday of 2020 Microsoft addressed 50 vulnerabilities, with seven of them labeled critical. The nastiest of the bunch, however, is a spoofing vulnerability (CVE-2020-0601) that affects Windows 10 and Windows Server 2016-2019 as well as applications that rely on Windows for trust functionality. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to defeat trusted network connections and deliver malicious code while making it appear the file was from a trusted, legitimate source. As Microsoft explained in a security update, “The user would have no way of knowing the file was malicious, because the digital signature would appear to be from a trusted provider.”

An attacker could also use the flaw to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software.

In its own security advisory about the vulnerability, which it labeled “critical,” the NSA warned that the flaw puts Windows systems at risk “to a broad range of exploitation vectors.”

“NSA assesses the vulnerability to be severe and that sophisticated cyber actors will understand the underlying flaw very quickly and, if exploited, would render the previously mentioned platforms as fundamentally vulnerable,” it said. “The consequences of not patching the vulnerability are severe and widespread. Remote exploitation tools will likely be made quickly and widely available. Rapid adoption of the patch is the only known mitigation at this time and should be the primary focus for all network owners.”

This vulnerability is also significant in that the NSA discovered the bug, and then reported it to Microsoft instead of weaponizing it like it did with the earlier EternalBlue vulnerability. The NSA did not immediately alert Microsoft about EternalBlue, and instead used it as a hacking tool for more than five years until a breach forced the agency to disclose the flaw so that Microsoft could issue a patch for it. Microsoft did, but just months later the vulnerability was exploited in two major global cyberattacks: WannaCry and NotPetya.

“For the U.S. government to share its discovery of a critical vulnerability with a vendor is exceptionally rare if not unprecedented,” said Amit Yoran, CEO of Tenable and the founding director of the Department of Homeland Security’s US-CERT program, in an email. “It underscores the criticality of the vulnerability and we urge all organizations to prioritize patching their systems quickly.”

Microsoft also reportedly provided an earlier fix to U.S. government and critical infrastructure customers, which Yoran said is “highly unusual.”

“These are clearly noteworthy shifts from regular practices and make this vulnerability worth paying attention to and also worth asking questions about,” he added. “How long ago was the vulnerability discovered? How long did it take from discovery to reporting? Was it used by the NSA? Has it been observed being used by foreign intelligence services already? What triggered the vendor disclosure? None of these questions change what organizations need to do at this point to protect themselves, but their answers might tell us a lot more about the environment we operate in.”

Neither Microsoft nor the NSA responded to specific questions. In its security update, however, Microsoft reported that the bug has not been exploited.

“A security update was released on January 14, 2020 and customers who have already applied the update, or have automatic updates enabled, are already protected. As always we encourage customers to install all security updates as soon as possible,” said Jeff Jones, senior director at Microsoft, in an emailed statement.

An NSA spokesperson directed SDxCentral to an official statement by Neal Ziring, technical director of the NSA Cybersecurity Directorate. It said the Microsoft patch “is the only comprehensive means to mitigate the risk … This vulnerability may not seem flashy, but it is a critical issue. Trust mechanisms are the foundations on which the internet operates – and CVE-2020-0601 permits a sophisticated threat actor to subvert those very foundations.”