{"id":"CVE-2020-0688","published":"2020-02-11T22:15:15Z","modified":"2026-06-17T02:46:21Z","title":"Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability","vendor":"Microsoft","product":"Exchange Server","tier":"core","eol":null,"description":{"text":"A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.","provenance":"source","from":"NVD"},"summary":{"text":"The Microsoft Exchange Server vulnerability is a remote code execution flaw in the Exchange software, where it fails to properly handle objects in memory, which leads to memory corruption. An attacker with network access and low-privileged authentication can exploit it without any user interaction to run code, with high impact to confidentiality, integrity and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:54:20Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99955,"percentile":0.99974,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0688","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-03-10","exploitedFirstSeen":"2020-03-10","ransomware":true,"evidence":[{"url":"https://cisa.gov/news-events/alerts/2020/03/10/unpatched-microsoft-exchange-servers-vulnerable-cve-2020-0688","date":"2020-03-10"},{"url":"https://www.welivesecurity.com/wp-content/uploads/2021/05/eset_threat_report_t12021.pdf","date":"2020-06-21"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-275a","date":"2020-10-20"},{"url":"https://media.cert.europa.eu/static/MEMO/2020/TLP-WHITE-CERT-EU-THREAT-MEMO-Thanos-ransomware.pdf","date":"2020-10-20"},{"url":"https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF","date":"2020-10-20"},{"url":"https://us-cert.cisa.gov/ncas/alerts/aa20-275a","date":"2020-10-20"},{"url":"https://us-cert.cisa.gov/ncas/alerts/aa20-296a","date":"2020-10-22"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-258a","date":"2020-10-24"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-296a","date":"2020-12-01"},{"url":"https://cdn.pathfactory.com/assets/10753/contents/298161/03f15d14-01bb-462b-a8d4-d8c6149f5604.pdf","date":"2021-03-05"}],"evidenceTotal":45,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688","tags":["Patch","Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-258/","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688","tags":["Patch","Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-258/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0688","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev","report-attack-id"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution; ATT&CK ID T1190 written in the same sentence as CVE-2020-0688","mappingType":"exploitation_technique","evidence":[{"reportId":"SRC-a55a5c8cf0c00663d69b","quote":"T1190 Exploit Public-Facing Application Gelsemium exploits the vulnerability CVE-2020-\r\n0688 .","start":31464,"end":31558}],"comment":"CVE-2020-0688 is a RCE vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory. A nation-state APT actor has been observed exploiting this vulnerability to conduct widespread, distributed, and anonymized brute force access attempts against hundreds of government and private sector targets worldwide.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1110","name":"Brute Force","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"CVE-2020-0688 is a RCE vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory. A nation-state APT actor has been observed exploiting this vulnerability to conduct widespread, distributed, and anonymized brute force access attempts against hundreds of government and private sector targets worldwide.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1114","name":"Email Collection","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"CVE-2020-0688 is a remote code execution vulnerability exists in Microsoft Exchange Server. CISA has observed the actors exploiting CVE-2020-0688 for remote code execution to enable email collection of targeted networks. Also, Threat actors used credentials in conjunction with known vulnerabilities on public-facing applications, such as virtual private networks (VPNs)—CVE-2020-0688 and CVE-2020-17144—to escalate privileges and gain remote code execution (RCE) on the exposed applications.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2020-0688 is a RCE vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory. A nation-state APT actor has been observed exploiting this vulnerability to conduct widespread, distributed, and anonymized brute force access attempts against hundreds of government and private sector targets worldwide.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1574","name":"Hijack Execution Flow","tactics":["execution","stealth"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[{"id":"SRC-a69a17064744ac89d968","title":"AA20-258A: Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity","publisher":"us-cert.cisa.gov","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-258a","date":null,"mentions":[{"quote":"CVE-2020-0688: Microsoft Exchange Server","start":9683,"end":9723},{"quote":"CISA has observed the actors exploiting CVE-2020-0688 for remote code execution to enable email collection of targeted networks.","start":9726,"end":9854},{"quote":"Within weeks of public disclosure of CVE-2020-0688, CISA analysts identified traffic that was indicative of Chinese MSS-affiliated threat actors attempting to exploit this vulnerability using the Collection [TA0009] technique listed in table 10.","start":18202,"end":18447},{"quote":"CISA observed the actors targeting CVE-2020-0688 to collect emails from the exchange servers found in Federal Government environments.","start":18563,"end":18697},{"quote":"CVE-2020-0688","start":22183,"end":22196}]},{"id":"SRC-a55a5c8cf0c00663d69b","title":"Eset gelsemium","publisher":"web-assets.esetstatic.com","url":"https://web-assets.esetstatic.com/wls/2021/06/eset_gelsemium.pdf","date":null,"mentions":[{"quote":"CVE-2020-0688, as the timeline fits and also Microsoft released an article following the security fix","start":5792,"end":5893},{"quote":"T1190 Exploit Public-Facing Application Gelsemium exploits the vulnerability CVE-2020-\r\n0688 .","start":31464,"end":31558},{"quote":"and CVE-2020-0688 .","start":32020,"end":32039}]},{"id":"SRC-48d0adadaab80eaf07f5","title":"U/OO/158036-21","publisher":"media.defense.gov","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF","date":null,"mentions":[{"quote":"servers using CVE 2020-0688 and CVE 2020-17144, for remote code execution and","start":1571,"end":1648},{"quote":"The actors used a variety of public exploits, including CVE\r\n2020-0688 and CVE 2020-17144 to gain privileged","start":4536,"end":4644}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-2181","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-2181","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":48153,"url":"https://www.exploit-db.com/exploits/48153","title":"Microsoft Exchange 2019 15.2.221.12 - Authenticated Remote Code Execution","type":"remote","platform":"windows","date":"2020-03-02","verified":false,"provenance":"source"},{"id":48168,"url":"https://www.exploit-db.com/exploits/48168","title":"Exchange Control Panel - Viewstate Deserialization (Metasploit)","type":"remote","platform":"windows","date":"2020-03-05","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2020-03-02"},"pocGithub":{"count":25,"skipped":0,"earliest":"2020-02-25","earliestUrl":"https://github.com/random-robbie/cve-2020-0688","repos":[{"name":"zcgonvh/CVE-2020-0688","url":"https://github.com/zcgonvh/CVE-2020-0688","stars":354,"created":"2020-03-01"},{"name":"Ridter/cve-2020-0688","url":"https://github.com/Ridter/cve-2020-0688","stars":327,"created":"2020-02-27"},{"name":"random-robbie/cve-2020-0688","url":"https://github.com/random-robbie/cve-2020-0688","stars":165,"created":"2020-02-25"},{"name":"Yt1g3r/CVE-2020-0688_EXP","url":"https://github.com/Yt1g3r/CVE-2020-0688_EXP","stars":144,"created":"2020-02-27"},{"name":"Jumbo-WJB/CVE-2020-0688","url":"https://github.com/Jumbo-WJB/CVE-2020-0688","stars":66,"created":"2020-02-26"}]},"metasploit":[{"name":"Exchange Control Panel ViewState Deserialization","module":"exploit/windows/http/exchange_ecp_viewstate","type":"exploit","disclosureDate":"2020-02-11","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_ecp_viewstate.rb"}],"first":{"date":"2020-02-11","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_ecp_viewstate.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"CVE-2020-0688 Exchange Exploitation via Web Log","id":"fce2c2e2-0fb5-41ab-a14c-5391e1fd70a5","level":"critical","status":"test","path":"rules-emerging-threats/2020/Exploits/CVE-2020-0688/web_cve_2020_0688_msexchange.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-0688/web_cve_2020_0688_msexchange.yml","techniques":["T1190"]},{"title":"CVE-2020-0688 Exploitation Attempt","id":"7c64e577-d72e-4c3d-9d75-8de6d1f9146a","level":"high","status":"test","path":"rules-emerging-threats/2020/Exploits/CVE-2020-0688/web_cve_2020_0688_exchange_exploit.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-0688/web_cve_2020_0688_exchange_exploit.yml","techniques":["T1190"]},{"title":"CVE-2020-0688 Exploitation via Eventlog","id":"d6266bf5-935e-4661-b477-78772735a7cb","level":"high","status":"test","path":"rules-emerging-threats/2020/Exploits/CVE-2020-0688/win_vul_cve_2020_0688.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-0688/win_vul_cve_2020_0688.yml","techniques":["T1190"]}]},"exploitRefs":["http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html","http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1110","T1114"],"provenance":"source"},{"stage":"secondary","techniques":["T1505.003"],"provenance":"source"},{"stage":"related","techniques":["T1574","T1068"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2020-02-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-0688","provenance":"source"},{"date":"2020-02-11","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2020-02-25, Exploit-DB 2020-03-02","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_ecp_viewstate.rb","provenance":"source"},{"date":"2020-03-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cisa.gov/news-events/alerts/2020/03/10/unpatched-microsoft-exchange-servers-vulnerable-cve-2020-0688","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-2181","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":631},"priority":{"score":86.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2424 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":7.74,"detail":"3 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 Exploit-DB entries; 25 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-exchange-server-cwe-287"}}