CVE-2020-0688highunder attackransomwareCWE-287

CVE-2020-0688: high-severity vulnerability in Microsoft Exchange Server 2010 Service Pack 3…

Published 11 Feb 2020 · Updated 21 Oct 2025

Follow this CVE + Monitor Microsoft Exchange Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 3 threat group(s) use it.

ssvc Actcvss 8.8epss 100%

from disclosure to weapon14 days

Published on NVDFeb 11

1st PoC+14d

metasploitFeb 11

CISA KEV+631d

Who exploits it — 3

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateDragonfly🇷🇺 MITRE ATT&CK

APT / StateKimsuky🇰🇵 MITRE ATT&CK

APT / StateMuddyWater🇮🇷 MITRE ATT&CK

Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

Microsoft Exchange has a vulnerability that allows attackers to run malicious code remotely on the server. This happens because the software doesn't properly manage data in memory, potentially giving unauthorized users full control of the email system.

Technical detail

A memory corruption vulnerability in Microsoft Exchange allows remote code execution when the application fails to properly validate or sanitize objects in memory. An authenticated attacker can exploit this to achieve arbitrary code execution with the privileges of the Exchange process, leading to complete compromise of the mail server.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Microsoft · Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30 Microsoft · Microsoft Exchange Server 2013 Microsoft · Microsoft Exchange Server 2016 Cumulative Update 14 Microsoft · Microsoft Exchange Server 2016 Cumulative Update 15 Microsoft · Microsoft Exchange Server 2019 Cumulative Update 3 Microsoft · Microsoft Exchange Server 2019 Cumulative Update 4

public PoCs found — 54✓ VexDay Proof

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — Microsoft Exchange Server 2010 Service Pack 3…

In the same product, most dangerous first.

CVE-2021-26855CRITICALMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 100.0%KEV CVE-2021-27065HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 99.9%KEV CVE-2021-26857HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 95.8%KEV CVE-2021-26858HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 93.7%KEV CVE-2019-0724—CVE-2019-0724EPSS 23.8%CVE-2019-1373—CVE-2019-1373EPSS 21.7%

References

http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0688 https://www.zerodayinitiative.com/advisories/ZDI-20-258/