What’s Vulnerable › Vulnerabilities

CVE-2020-0618: Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-09-18
• EPSS: 99.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-02-11 · updated 2026-08-15
• Weakness: CWE-502

Description

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.

Affected products

• Microsoft SQL Server: 2012-sp4, 2014-sp3, 2016-sp2
• Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU): all versions
• Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR): all versions
• Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU): all versions
• Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR): all versions
• Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR): all versions
• Microsoft SQL Server: 2012 for 32-bit Systems Service Pack 4 (QFE), 2012 for x64-based Systems Service Pack 4 (QFE), 2016 for x64-based Systems Service Pack 2 (CU)

References

• http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html
• http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618
• http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html
• http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0618

Get alerted when CVE-2020-0618 or the next vulnerability affects your stack