CVE-2020-0796

Microsoft SMBv3 Remote Code Execution Vulnerability

Published Mar 12, 2020 · updated Oct 1, 2026 · microsoft windows 10 1903

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.

Timeline

Detection, updates, and resolution for this record.

Mar 12, 2020 · Catalog
Detected
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.
Feb 10, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Aug 10, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Oct 1, 2026 · Catalog
Updated
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.

Required action

Apply updates per vendor instructions.

CISA due date Aug 10, 2022

Affected

cpe microsoft/windows 10 1903version unspecified
cpe microsoft/windows 10 1909version unspecified
cpe microsoft/windows server 1903version unspecified
cpe microsoft/windows server 1909version unspecified
vendor Microsoft SMBv3version unspecified

Sources

CISA KEVCVE-2020-0796
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.
cisa.gov
CVE.orgCVE-2020-0796
Official CVE identifier
cve.org
FIRST EPSSCVE-2020-0796
30-day exploitation probability 99.8%
first.org
Exploit Database48216
Public archive entry. The exploit body is not stored here.
exploit-db.com
Exploit Database48267
Public archive entry. The exploit body is not stored here.
exploit-db.com
Exploit Database48537
Public archive entry. The exploit body is not stored here.
exploit-db.com
Metasploit Modulesexploit_windows/local/cve_2020_0796_smbghost
Public module reference (good). Module source is not copied into this catalog.
rapid7.com
Metasploit Modulesexploit_windows/smb/cve_2020_0796_smbghost
Public module reference (average). Module source is not copied into this catalog.
rapid7.com
NIST NVDCVE-2020-0796
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
nvd.nist.gov
Packet Storm Securityhttp://packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1-Proof-Of-Concept.html
Packet Storm link already published on the finding.
packetstormsecurity.com
Packet Storm Securityhttp://packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com
Packet Storm Securityhttp://packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-Local-Privilege-Escalation.html
Packet Storm link already published on the finding.
packetstormsecurity.com
Packet Storm Securityhttp://packetstormsecurity.com/files/157110/SMBv3-Compression-Buffer-Overflow.html
Packet Storm link already published on the finding.
packetstormsecurity.com
Packet Storm Securityhttp://packetstormsecurity.com/files/157901/Microsoft-Windows-SMBGhost-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com
Packet Storm Securityp://packetstormsecurity.com/files/158054/SMBleed-SMBGhost-Pre-Authentication-Remote-Code-Execution-Proof-Of-Concept.html
Packet Storm link already published on the finding.
packetstormsecurity.com