ZeroDay Findings
Sign inSign up

Findings

CVE-2020-0646

Microsoft .NET Framework Remote Code Execution Vulnerability

Published Jan 14, 2020 · updated Jun 16, 2026 · microsoft .net framework

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 14, 2020 · Catalog

    Detected

    A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe microsoft/.net framework3.0
  • cpe microsoft/.net framework3.5
  • cpe microsoft/.net framework3.5.1
  • cpe microsoft/.net framework4.5.2
  • cpe microsoft/.net framework4.6.2
  • cpe microsoft/.net framework4.7
  • cpe microsoft/.net framework4.7.1
  • cpe microsoft/.net framework4.7.2
  • vendor Microsoft .NET Frameworkversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2020-0646

    Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2020-0646

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2020-0646

    30-day exploitation probability 99.2%

    first.org
  • Exploit DatabasePublic exploit reference48275

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit ModulesPublic exploit moduleexploit_windows/http/sharepoint_workflows_xoml

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2020-0646

    A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.

    nvd.nist.gov
  • Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/156930/SharePoint-Workflows-XOML-Injection.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References