peter bassill · operator
$ cve CVE-2020-0796 JSON

CVE-2020-0796 KEV EXPLOIT

10.0
CRITICAL · CVSS 3.1 · EPSS 99.8% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-08-10.

Description

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

Scoring

CVSS10.0 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS99.81% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-119
On CISA KEVyes — remediate by 2022-08-10
Public exploityes
Published2020-03-12
Last modified2026-08-12

CISA KEV

NameMicrosoft SMBv3 Remote Code Execution Vulnerability
Added2022-02-10
Due2022-08-10
Vendor / productMicrosoft / SMBv3
Ransomware useknown

Affected (4)

VendorProduct
microsoftwindows 10 1903
microsoftwindows 10 1909
microsoftwindows server 1903
microsoftwindows server 1909

Public exploits

SourceTitleDate
exploit-dbMicrosoft Windows - 'SMBGhost' Remote Code Execution2020-06-02
exploit-dbMicrosoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Local Privilege Escalation2020-03-30
exploit-dbMicrosoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Buffer Overflow (PoC)2020-03-14

References

→ the Explorer  ·  watch your stack  ·  NVD