Microsoft · SMBv3
CVE-2020-0796
Microsoft SMBv3 Remote Code Execution Vulnerability
What it is
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
CISA: A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: August 10, 2022
- Added to the CISA list
- February 10, 2022
- Published
- March 12, 2020
- Severity
- Critical 10.0 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.8% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-119
- More details
- NVD · CVE.org · CISA
All references (7)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796
- http://packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1-Proof-Of-Conce…
- http://packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-Local-Privilege-Escalation.html
- http://packetstormsecurity.com/files/157110/SMBv3-Compression-Buffer-Overflow.html
- http://packetstormsecurity.com/files/157901/Microsoft-Windows-SMBGhost-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/158054/SMBleed-SMBGhost-Pre-Authentication-Remote-Code-Execution-Proof-O…
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 13, 2026 | Command Injection | Windows | High 8.8 | 9.8% |
| Sep 25, 2026 | Code Injection | SharePoint | High 8.8 | 8.2% |
| Sep 8, 2026 | Link Following | Windows | High 7.8 | 0.4% |
| Sep 8, 2026 | Heap-Based Buffer Overflow | Windows | High 7.8 | 0.4% |
| Aug 26, 2026 | Remote Code Execution | SQL Server | High 8.8 | 57% |
| Aug 18, 2026 | Double Free | Internet Key Exchange (IKE) Service Extensions | Critical 9.8 | 77% |
| Aug 18, 2026 | Weak Authentication | SharePoint | Critical 9.1 | 70% |
| Aug 11, 2026 | Windows Ancillary Function Driver for WinSock Use-After-Free | Windows Ancillary Function Driver for WinSock | High 7.0 | 0.3% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.