CVEvulnerability

CVE-2020-0796

10.0 CRITICAL Known exploited Published 2020-03-12 Modified 2026-10-01 Official page ↗

CISA Known Exploited Vulnerability

Microsoft SMBv3 Remote Code Execution Vulnerability — Microsoft SMBv3

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.

Added to KEV
2022-02-10
Remediation due
2022-08-10
Ransomware use
Known
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2020-0796
Status
Analyzed
Published
2020-03-12
Last modified
2026-10-01
Assigner
[email protected]
CVSS 3.1 ([email protected])
10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-119

Description

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

Affected configurations

• microsoft windows 10 1903 • microsoft windows 10 1909 • microsoft windows server 1903 • microsoft windows server 1909

Related

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References