CVE-2020-0688

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

Score

CVSS 3.1 8.8 High

Status

Analyzed - secure@microsoft.com

Published

2020-02-11

Last modified

2025-10-21

Known exploited (CISA KEV)

since 2021-11-03, action due 2022-05-03: Apply updates per vendor instructions.

Weaknesses

CWE-287

Affected products

• Exchange Server (Microsoft)
• Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30 (Microsoft)
• Microsoft Exchange Server 2013 (Microsoft)
• Microsoft Exchange Server 2016 Cumulative Update 14 (Microsoft)
• Microsoft Exchange Server 2016 Cumulative Update 15 (Microsoft)
• Microsoft Exchange Server 2019 Cumulative Update 3 (Microsoft)
• Microsoft Exchange Server 2019 Cumulative Update 4 (Microsoft)

References

• http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688
• https://www.zerodayinitiative.com/advisories/ZDI-20-258/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0688