ZeroDay Findings
Sign inSign up

Findings

CVE-2020-0646

Microsoft .NET Framework Remote Code Execution Vulnerability

Published Jan 14, 2020 · updated Jun 16, 2026 · microsoft .net framework

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 14, 2020 · Catalog

    Detected

    A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe microsoft/.net framework3.0
  • cpe microsoft/.net framework3.5
  • cpe microsoft/.net framework3.5.1
  • cpe microsoft/.net framework4.5.2
  • cpe microsoft/.net framework4.6.2
  • cpe microsoft/.net framework4.7
  • cpe microsoft/.net framework4.7.1
  • cpe microsoft/.net framework4.7.2
  • vendor Microsoft .NET Frameworkversion unspecified

Sources

  • CISA KEVCVE-2020-0646

    Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution.

    cisa.gov
  • CVE.orgCVE-2020-0646

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-0646

    30-day exploitation probability 99.2%

    first.org
  • Exploit Database48275

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_windows/http/sharepoint_workflows_xoml

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2020-0646

    A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/156930/SharePoint-Workflows-XOML-Injection.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References

CVE-2020-0646 · ZeroDay Findings