What’s Vulnerable › Vulnerabilities
CVE-2020-0688: Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2021-11-03
- EPSS: 100.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-02-11 · updated 2026-06-17
- Weakness: CWE-287
Description
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
Affected products
- Microsoft Exchange Server: 2010-sp3_rollup_30, 2013-cumulative_update_23, 2016-cumulative_update_14, 2016-cumulative_update_15, 2019-cumulative_update_3, 2019-cumulative_update_4
- Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30: all versions
- Microsoft Exchange Server 2013: Cumulative Update 23
- Microsoft Exchange Server 2016 Cumulative Update 14: all versions
- Microsoft Exchange Server 2016 Cumulative Update 15: all versions
- Microsoft Exchange Server 2019 Cumulative Update 3: all versions
- Microsoft Exchange Server 2019 Cumulative Update 4: all versions
References
- http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688
- https://www.zerodayinitiative.com/advisories/ZDI-20-258/
- http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688
- https://www.zerodayinitiative.com/advisories/ZDI-20-258/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0688
Get alerted when CVE-2020-0688 or the next vulnerability affects your stack