Microsoft · Exchange Server
CVE-2020-0688
Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
Exploited in attacks
Used by ransomware
High 8.8 Attack chance: >99.9%
What it is
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
CISA: Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- February 11, 2020
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- >99.9% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-287
- More details
- NVD · CVE.org · CISA
All references (4)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688
- https://www.zerodayinitiative.com/advisories/ZDI-20-258/
- http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 13, 2026 | Deserialization of Untrusted Data | Exchange Server | High 8.8 | 59% |
| Aug 21, 2024 | Information Disclosure | Exchange Server | High 7.2 | 54% |
| Feb 15, 2024 | Privilege Escalation | Exchange Server | Critical 9.8 | 13% |
| Jan 10, 2023 | Privilege Escalation | Exchange Server | High 8.8 | 77% |
| Sep 30, 2022 | Server-Side Request Forgery | Exchange Server | High 8.8 | >99.9% |
| Sep 30, 2022 | Remote Code Execution | Exchange Server | High 8.0 | >99.9% |
| Mar 3, 2022 | Privilege Escalation | Exchange Server | High 7.4 | 27% |
| Jan 18, 2022 | Information Disclosure | Exchange Server | High 7.3 | 98% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.