Microsoft · SQL Server
CVE-2020-0618
Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability
What it is
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
CISA: Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: October 9, 2024
- Added to the CISA list
- September 18, 2024
- Published
- February 11, 2020
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.0% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-502
- More details
- NVD · CVE.org · CISA
All references (3)
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 26, 2026 | Remote Code Execution | SQL Server | High 8.8 | 57% |
| Oct 13, 2026 | Command Injection | Windows | High 8.8 | 9.8% |
| Sep 25, 2026 | Code Injection | SharePoint | High 8.8 | 8.2% |
| Sep 8, 2026 | Link Following | Windows | High 7.8 | 0.4% |
| Sep 8, 2026 | Heap-Based Buffer Overflow | Windows | High 7.8 | 0.4% |
| Aug 18, 2026 | Double Free | Internet Key Exchange (IKE) Service Extensions | Critical 9.8 | 77% |
| Aug 18, 2026 | Weak Authentication | SharePoint | Critical 9.1 | 70% |
| Aug 11, 2026 | Windows Ancillary Function Driver for WinSock Use-After-Free | Windows Ancillary Function Driver for WinSock | High 7.0 | 0.3% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.