{"id":"CVE-2020-0618","aliases":["EUVD-2020-2113","GHSA-jcvj-vhj2-vgmw"],"status":"published","title":"A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it...","description":"A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.99046,"percentile":0.99931,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-20","CWE-502"],"published":"2020-02-11T21:22:45Z","modified":"2026-08-15T04:17:46Z","kev":{"date_added":"2024-09-18","due_date":"2024-10-09","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2024-09-18"},{"source":"kev","since":"2024-09-18"}],"exploits":[{"source":"metasploit","id":"exploit/windows/http/ssrs_navcorrector_viewstate","title":"SQL Server Reporting Services (SSRS) ViewState Deserialization","type":"exploit","platform":"Windows","date":"2020-02-11","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/http/ssrs_navcorrector_viewstate"},{"source":"pocgithub","id":"euphrat1ca/CVE-2020-0618","title":"euphrat1ca/CVE-2020-0618","date":"2020-02-15","url":"https://github.com/euphrat1ca/CVE-2020-0618"},{"source":"pocgithub","id":"wortell/cve-2020-0618","title":"wortell/cve-2020-0618","date":"2020-02-18","url":"https://github.com/wortell/cve-2020-0618"},{"source":"exploitdb","id":"EDB-48816","title":"Microsoft SQL Server Reporting Services 2016 - Remote Code Execution","type":"remote","platform":"windows","date":"2020-09-17","url":"https://www.exploit-db.com/exploits/48816"},{"source":"pocgithub","id":"itstarsec/CVE-2020-0618","title":"itstarsec/CVE-2020-0618","date":"2022-05-13","url":"https://github.com/itstarsec/CVE-2020-0618"},{"source":"pocgithub","id":"N3xtGenH4cker/CVE-2020-0618_DETECTION","title":"N3xtGenH4cker/CVE-2020-0618_DETECTION","date":"2025-03-28","url":"https://github.com/N3xtGenH4cker/CVE-2020-0618_DETECTION"},{"source":"nuclei","id":"CVE-2020-0618","title":"Microsoft SQL Server Reporting Services - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-0618.yaml"}],"products":[{"vendor":"microsoft","product":"microsoft sql server"},{"vendor":"microsoft","product":"microsoft sql server 2014 service pack 3 for 32-bit systems (cu)"},{"vendor":"microsoft","product":"microsoft sql server 2014 service pack 3 for 32-bit systems (gdr)"},{"vendor":"microsoft","product":"microsoft sql server 2014 service pack 3 for x64-based systems (cu)"},{"vendor":"microsoft","product":"microsoft sql server 2014 service pack 3 for x64-based systems (gdr)"},{"vendor":"microsoft","product":"microsoft sql server 2016 for x64-based systems service pack 2 (gdr)"},{"vendor":"microsoft","product":"sql server"},{"vendor":"microsoft","product":"sql_server"}],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0618","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-0618"},{"url":"https://github.com/advisories/GHSA-jcvj-vhj2-vgmw"}],"sources":{"cve":[{"id":"CVE-2020-0618","description":"A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.","status":"published","published":"2020-02-11T21:22:45Z","modified":"2026-08-15T03:55:30.558Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:35:59.763887Z"}],"euvd":[{"id":"EUVD-2020-2113","description":"A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.","status":"published","published":"2020-02-11T21:22:45Z","modified":"2026-08-15T03:55:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-09-18","updated_at":"2026-11-02T18:01:53.008072Z"}],"ghsa":[{"id":"GHSA-jcvj-vhj2-vgmw","title":"A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it...","description":"A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.","status":"published","published":"2022-05-24T17:08:24Z","modified":"2025-10-22T00:32:53Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20","CWE-502"],"updated_at":"2026-11-02T15:04:07.112106Z"}],"kev":[{"id":"CVE-2020-0618","title":"Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability","description":"Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.","cwes":["CWE-502"],"kev":{"date_added":"2024-09-18","due_date":"2024-10-09","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2020-0618","description":"A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.","status":"published","published":"2020-02-11T22:15:13.4Z","modified":"2026-08-15T04:17:46.01Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:05:53.837808Z"}]}}