{"id":"CVE-2020-1350","aliases":["EUVD-2020-12226","GHSA-hcmx-443w-mr76"],"status":"published","title":"A remote code execution vulnerability exists in Windows Domain Name System servers when they fail...","description":"A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.96721,"percentile":0.99885,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-119","CWE-20","CWE-787"],"published":"2020-07-14T22:54:06Z","modified":"2026-06-17T03:01:10Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"pocgithub","id":"psc4re/NSE-scripts","title":"psc4re/NSE-scripts","date":"2020-03-11","url":"https://github.com/psc4re/NSE-scripts"},{"source":"pocgithub","id":"ZephrFish/CVE-2020-1350_HoneyPoC","title":"ZephrFish/CVE-2020-1350_HoneyPoC","date":"2020-07-14","url":"https://github.com/ZephrFish/CVE-2020-1350_HoneyPoC"},{"source":"pocgithub","id":"mr-r3b00t/CVE-2020-1350","title":"mr-r3b00t/CVE-2020-1350","date":"2020-07-14","url":"https://github.com/mr-r3b00t/CVE-2020-1350"},{"source":"pocgithub","id":"zoomerxsec/Fake_CVE-2020-1350","title":"zoomerxsec/Fake_CVE-2020-1350","date":"2020-07-14","url":"https://github.com/zoomerxsec/Fake_CVE-2020-1350"},{"source":"pocgithub","id":"T13nn3s/CVE-2020-1350","title":"T13nn3s/CVE-2020-1350","date":"2020-07-15","url":"https://github.com/T13nn3s/CVE-2020-1350"},{"source":"pocgithub","id":"corelight/SIGRed","title":"corelight/SIGRed","date":"2020-07-15","url":"https://github.com/corelight/SIGRed"},{"source":"pocgithub","id":"jmaddington/dRMM-CVE-2020-1350-response","title":"jmaddington/dRMM-CVE-2020-1350-response","date":"2020-07-15","url":"https://github.com/jmaddington/dRMM-CVE-2020-1350-response"},{"source":"pocgithub","id":"maxpl0it/CVE-2020-1350-DoS","title":"maxpl0it/CVE-2020-1350-DoS","date":"2020-07-15","url":"https://github.com/maxpl0it/CVE-2020-1350-DoS"},{"source":"pocgithub","id":"captainGeech42/CVE-2020-1350","title":"captainGeech42/CVE-2020-1350","date":"2020-07-16","url":"https://github.com/captainGeech42/CVE-2020-1350"},{"source":"pocgithub","id":"connormcgarr/CVE-2020-1350","title":"connormcgarr/CVE-2020-1350","date":"2020-07-17","url":"https://github.com/connormcgarr/CVE-2020-1350"},{"source":"pocgithub","id":"graph-inc/CVE-2020-1350","title":"graph-inc/CVE-2020-1350","date":"2020-07-18","url":"https://github.com/graph-inc/CVE-2020-1350"},{"source":"pocgithub","id":"CVEmaster/CVE-2020-1350","title":"CVEmaster/CVE-2020-1350","date":"2020-07-19","url":"https://github.com/CVEmaster/CVE-2020-1350"},{"source":"pocgithub","id":"gdwnet/cve-2020-1350","title":"gdwnet/cve-2020-1350","date":"2020-07-22","url":"https://github.com/gdwnet/cve-2020-1350"},{"source":"pocgithub","id":"simeononsecurity/CVE-2020-1350-Fix","title":"simeononsecurity/CVE-2020-1350-Fix","date":"2020-07-26","url":"https://github.com/simeononsecurity/CVE-2020-1350-Fix"},{"source":"pocgithub","id":"Sheisback/CVE-2020-1350-Exploit","title":"Sheisback/CVE-2020-1350-Exploit","date":"2020-11-26","url":"https://github.com/Sheisback/CVE-2020-1350-Exploit"},{"source":"pocgithub","id":"sty886/CVE-2020-1350-SigRed","title":"sty886/CVE-2020-1350-SigRed","date":"2026-03-07","url":"https://github.com/sty886/CVE-2020-1350-SigRed"}],"products":[{"vendor":"microsoft","product":"windows"},{"vendor":"microsoft","product":"windows server"},{"vendor":"microsoft","product":"windows server, version 1903 (server core installation)"},{"vendor":"microsoft","product":"windows server, version 1909 (server core installation)"},{"vendor":"microsoft","product":"windows server, version 2004 (server core installation)"},{"vendor":"microsoft","product":"windows_server_2008"},{"vendor":"microsoft","product":"windows_server_2012"},{"vendor":"microsoft","product":"windows_server_2016"},{"vendor":"microsoft","product":"windows_server_2019"}],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/158484/SIGRed-Windows-DNS-Denial-Of-Service.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1350","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1350"},{"url":"https://github.com/advisories/GHSA-hcmx-443w-mr76"}],"sources":{"cve":[{"id":"CVE-2020-1350","description":"A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.","status":"published","published":"2020-07-14T22:54:06Z","modified":"2025-10-21T23:35:39.529Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:56.213477Z"}],"euvd":[{"id":"EUVD-2020-12226","description":"A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.","status":"published","published":"2020-07-14T22:54:06Z","modified":"2025-10-21T23:35:39Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T20:31:24.816637Z"}],"ghsa":[{"id":"GHSA-hcmx-443w-mr76","title":"A remote code execution vulnerability exists in Windows Domain Name System servers when they fail...","description":"A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.","status":"published","published":"2022-05-24T17:22:59Z","modified":"2025-10-22T00:31:56Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-119","CWE-787"],"updated_at":"2026-11-02T15:04:04.786232Z"}],"kev":[{"id":"CVE-2020-1350","title":"Microsoft Windows DNS Server Remote Code Execution Vulnerability","description":"Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2020-1350","description":"A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.","status":"published","published":"2020-07-14T23:15:13.087Z","modified":"2026-06-17T03:01:10.59Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:06:09.126752Z"}]}}