Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Feb 11, 2020 · Catalog

   Detected

   Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.

2. Sep 18, 2024 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Oct 9, 2024 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Aug 14, 2026 · Catalog

   Updated

   Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.

Affected

• cpe microsoft/sql server2012
• cpe microsoft/sql server2014
• cpe microsoft/sql server2016
• vendor Microsoft SQL Serverversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2020-0618

  Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.

  cisa.gov
• CVE.orgVulnerability recordCVE-2020-0618

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2020-0618

  30-day exploitation probability 99.0%

  first.org
• Exploit DatabasePublic exploit reference48816

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Metasploit ModulesPublic exploit moduleexploit_windows/http/ssrs_navcorrector_viewstate

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDVulnerability recordCVE-2020-0618

  A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.

  nvd.nist.gov
• Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com
• Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com

References

• Exploit · packetstormsecurity.com
• Exploit · packetstormsecurity.com
• CISA note · msrc.microsoft.com
• CISA note · nvd.nist.gov
• Patch · portal.msrc.microsoft.com
• US Government Resource · cisa.gov