CVE-2020-1359

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability exists when the Windows Cryptography Next Generation (CNG) Key Isolation service improperly handles memory, aka 'Windows CNG Key Isolation Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1384.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
MicrosoftWindows 10 Version 2004 for 32-bit Systemsunspecified
MicrosoftWindows 10 Version 2004 for ARM64-based Systemsunspecified
MicrosoftWindows 10 Version 2004 for x64-based Systemsunspecified
MicrosoftWindows Server, version 2004 (Server Core installation)unspecified
MicrosoftWindows10 Version 1803 for 32-bit Systems; 10 Version 1803 for x64-based Systems; 10 Version 1803 for ARM64-based Systems; 10 Version 1809 for 32-bit Systems; 10 Version 1809 for x64-based Systems; 10 Version 1809 for ARM64-based Systems; 10 Version 1709 for 32-bit Systems; 10 Version 1709 for x64-based Systems; 10 Version 1709 for ARM64-based Systems; 10 for 32-bit Systems; 10 for x64-based Systems; 10 Version 1607 for 32-bit Systems; 10 Version 1607 for x64-based Systems; 7 for 32-bit Systems Service Pack 1; 7 for x64-based Systems Service Pack 1; 8.1 for 32-bit systems; 8.1 for x64-based systems; RT 8.1
MicrosoftWindows Server2019; 2019 (Core installation); 2016; 2016 (Core installation); 2008 for 32-bit Systems Service Pack 2; 2008 for 32-bit Systems Service Pack 2 (Core installation); 2008 for x64-based Systems Service Pack 2; 2008 for x64-based Systems Service Pack 2 (Core installation); 2008 R2 for x64-based Systems Service Pack 1; 2008 R2 for x64-based Systems Service Pack 1 (Core installation); 2012; 2012 (Core installation); 2012 R2; 2012 R2 (Core installation)
MicrosoftWindows 10 Version 1909 for 32-bit Systemsunspecified
MicrosoftWindows 10 Version 1909 for x64-based Systemsunspecified
MicrosoftWindows 10 Version 1909 for ARM64-based Systemsunspecified
MicrosoftWindows Server, version 1909 (Server Core installation)unspecified
MicrosoftWindows 10 Version 1903 for 32-bit Systemsunspecified
MicrosoftWindows 10 Version 1903 for x64-based Systemsunspecified
MicrosoftWindows 10 Version 1903 for ARM64-based Systemsunspecified
MicrosoftWindows Server, version 1903 (Server Core installation)unspecified

References

Timeline

Published
Jul 14, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-135907.2Multiple exploitable SQL injection vulnerabilities exist in the 'entities/fields' page of the Rukovoditel Project Management App 2.7.2. A spCVE-2020-135918.8An exploitable SQL injection vulnerability exists in the "access_rules/rules_form" page of the Rukovoditel Project Management App 2.7.2. A sCVE-2020-135928.8An exploitable SQL injection vulnerability exists in "global_lists/choices" page of the Rukovoditel Project Management App 2.7.2. A speciallCVE-2020-135938.8The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation in Texas Instruments SimpleLink SIMPLELINK-CC2640R2-SDK through 2.2.3 CVE-2020-135946.5The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.2 and earlier (for ESP32 devices) does not properly restrictCVE-2020-135956.5The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) returns the wrong number oCVE-2020-135966.1An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidgCVE-2020-135973.5Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure iCVE-2020-135987.8FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_stat. Zephyr versions >= v1.14.2, >= v2.3.0 contain Stack-based BCVE-2020-135993.3Security problem with settings and littlefs. Zephyr versions >= 1.14.2, >= 2.3.0 contain Incorrect Default Permissions (CWE-276). For more iCVE-2020-13607.8An elevation of privilege vulnerability exists when the Windows Profile Service improperly handles file operations, aka 'Windows Profile SerCVE-2020-136007.6Malformed SPI in response for eswifi can corrupt kernel memory. Zephyr versions >= 1.14.2, >= 2.3.0 contain Heap-based Buffer Overflow (CWE-