Microsoft · .NET Framework

CVE-2020-0646

Microsoft .NET Framework Remote Code Execution Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 99.2%

What it is

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.

CISA: Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: May 3, 2022

Added to the CISA list: November 3, 2021
Published: January 14, 2020
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 99.2% in the top 0.1% of all known vulnerabilities
Weakness: CWE-91
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from Microsoft

Added	Vulnerability	Product	Severity	Attack chance
Feb 4, 2025	Information DisclosureCVE-2024-29059	.NET Framework	High 7.5	99%
Nov 3, 2021	Remote Code ExecutionCVE-2017-8759	.NET Framework	High 7.8	89%
Oct 13, 2026	Command InjectionCVE-2026-96951	Windows	High 8.8	9.8%
Sep 25, 2026	Code InjectionCVE-2026-65660	SharePoint	High 8.8	8.2%
Sep 8, 2026	Link FollowingCVE-2026-81963	Windows	High 7.8	0.4%
Sep 8, 2026	Heap-Based Buffer OverflowCVE-2026-85880	Windows	High 7.8	0.4%
Aug 26, 2026	Remote Code ExecutionCVE-2019-1068	SQL Server	High 8.8	57%
Aug 18, 2026	Double FreeCVE-2026-33824	Internet Key Exchange (IKE) Service Extensions	Critical 9.8	77%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.