Every CVE Search/ Get API key

CVE-2020-0688

A remote code execution vulnerability exists in Microsoft Exchange software when the software...

8.8 HighIn KEVPublic exploit

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 12.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

Record
CVE-2020-0688
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Weakness
CWE-287
Updated
2026-11-02
CVE List 8.8

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

Record
CVE-2020-0688
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
EUVDEUVD-2020-2181 8.8

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

Record
EUVD-2020-2181
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-4g56-8mc7-hpjq 8.8

A remote code execution vulnerability exists in Microsoft Exchange software when the software...

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

Record
GHSA-4g56-8mc7-hpjq
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287, CWE-502, CWE-798
Updated
2026-11-02
CISA KEV No score

Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.

Record
CVE-2020-0688
Weakness
CWE-287
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitExchange Control Panel ViewState Deserialization2020-02-11
PoC in GitHubrandom-robbie/cve-2020-06882020-02-25
PoC in GitHubJumbo-WJB/CVE-2020-06882020-02-26
PoC in GitHubRidter/cve-2020-06882020-02-27
PoC in GitHubYt1g3r/CVE-2020-0688_EXP2020-02-27
PoC in GitHubonSec-fr/CVE-2020-0688-Scanner2020-02-28
PoC in GitHubtruongtn/cve-2020-06882020-02-28
PoC in GitHubyouncyb/CVE-2020-06882020-02-28
PoC in GitHubzcgonvh/CVE-2020-06882020-03-01
Exploit-DBMicrosoft Exchange 2019 15.2.221.12 - Authenticated Remote Code Execution2020-03-02
Show 18 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubjustin-p/PSForgot2kEyXCHANGE2020-03-04
Exploit-DBExchange Control Panel - Viewstate Deserialization (Metasploit)2020-03-05
PoC in GitHubbailongwang1/CVE-2020-06882020-03-09
PoC in GitHubcert-lv/CVE-2020-06882020-03-19
PoC in GitHubravinacademy/CVE-2020-06882020-03-31
PoC in GitHubmahyarx/Exploit_CVE-2020-06882020-04-05
PoC in GitHubktpdpro/CVE-2020-06882020-04-22
PoC in GitHubw4fz5uck5/cve-2020-0688-webshell-upload-technique2020-06-12
PoC in GitHubmurataydemir/CVE-2020-06882020-08-17
PoC in GitHubzyn3rgy/ecp_slap2020-10-23
PoC in GitHubSLSteff/CVE-2020-0688-Scanner2020-10-29
PoC in GitHubMrTiz/CVE-2020-06882021-01-04
PoC in GitHub7heKnight/CVE-2020-06882022-05-12
PoC in GitHub1337-llama/CVE-2020-0688-Python32022-10-19
PoC in GitHubchudamax/CVE-2020-0688-Exchange20102023-08-02
PoC in GitHubW01fh4cker/CVE-2020-0688-GUI2024-05-09
PoC in GitHubtvdat20004/CVE-2020-06882025-08-04
PoC in GitHubiamwajd/Cyber-Attack-Analysis2026-02-18

History

History
RecordedChangedSources
exploitation
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-0688 is a high vulnerability (CVSS 8.8) in Microsoft Exchange Server, published February 11, 2020. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open