CVE-2020-0688
Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
Published Feb 11, 2020 · updated Jun 16, 2026 · microsoft exchange server
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Feb 11, 2020 · Catalog
Detected
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe microsoft/exchange server2010
- cpe microsoft/exchange server2013
- cpe microsoft/exchange server2016
- cpe microsoft/exchange server2019
- vendor Microsoft Exchange Serverversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2020-0688
Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.
cisa.gov - CVE.orgVulnerability recordCVE-2020-0688
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2020-0688
30-day exploitation probability 100.0%
first.org - Exploit DatabasePublic exploit reference48153
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit DatabasePublic exploit reference48168
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit ModulesPublic exploit moduleexploit_windows/http/exchange_ecp_viewstate
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2020-0688
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
nvd.nist.gov - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html
Packet Storm link already published on the finding.
packetstormsecurity.com