CVE-2020-0688
Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
Published Feb 11, 2020 · updated Jun 16, 2026 · microsoft exchange server
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
Timeline
Detection, updates, and resolution for this record.
Feb 11, 2020 · Catalog
Detected
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe microsoft/exchange server2010
- cpe microsoft/exchange server2013
- cpe microsoft/exchange server2016
- cpe microsoft/exchange server2019
- vendor Microsoft Exchange Serverversion unspecified
Sources
- CISA KEVCVE-2020-0688
Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.
cisa.gov - CVE.orgCVE-2020-0688
Official CVE identifier
cve.org - FIRST EPSSCVE-2020-0688
30-day exploitation probability 100.0%
first.org - Exploit Database48153
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database48168
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_windows/http/exchange_ecp_viewstate
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2020-0688
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html
Packet Storm link already published on the finding.
packetstormsecurity.com