CVE-2020-0796A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution…
Updated under an hour ago ()
Does this affect you?
It affects Microsoft Windows 10 Version 1903 for 32-bit Systems and 11 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Feb 10, 2022; federal agencies had to remediate by Aug 10, 2022, and it is known to be used in ransomware. Treat that date as your deadline.
Do this next
Free account, 1 product
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
- CVSS
- 10.0 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-119
- Known exploited
- Added to CISA KEV Feb 10, 2022; federal remediation due Aug 10, 2022; known ransomware useApply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 99.81% (percentile 100)
- Assigned by
- microsoft
- NVD analysis
- Analyzed
- Record last updated
- Oct 1, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Microsoft Windows 10 Version 1903 for 32-bit Systems microsoft:windows_10_version_1903_for_32_bit_systems (from the name) | unspecified | CNA record |
Microsoft Windows 10 Version 1903 for x64-based Systems microsoft:windows_10_version_1903_for_x64_based_systems (from the name) | unspecified | CNA record |
Microsoft Windows 10 Version 1903 for ARM64-based Systems microsoft:windows_10_version_1903_for_arm64_based_systems (from the name) | unspecified | CNA record |
Microsoft Windows Server, version 1903 (Server Core installation) microsoft:windows_server_version_1903_server_core_installation (from the name) | unspecified | CNA record |
Microsoft Windows 10 Version 1909 for 32-bit Systems microsoft:windows_10_version_1909_for_32_bit_systems (from the name) | unspecified | CNA record |
Microsoft Windows 10 Version 1909 for x64-based Systems microsoft:windows_10_version_1909_for_x64_based_systems (from the name) | unspecified | CNA record |
Microsoft Windows 10 Version 1909 for ARM64-based Systems microsoft:windows_10_version_1909_for_arm64_based_systems (from the name) | unspecified | CNA record |
Microsoft Windows Server, version 1909 (Server Core installation) microsoft:windows_server_version_1909_server_core_installation (from the name) | unspecified | CNA record |
microsoft windows_10_1903 microsoft:windows_10_1903 | all versions; all versions; all versions | NVD |
microsoft windows_10_1909 microsoft:windows_10_1909 | all versions; all versions; all versions | NVD |
microsoft windows_server_1903 microsoft:windows_server_1903 | all versions | NVD |
microsoft windows_server_1909 microsoft:windows_server_1909 | all versions | NVD |
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796x-refsource-misc, patch, vendor-advisory
- http://packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1-Proof-Of-Concept.htmlx-refsource-misc, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.htmlx-refsource-misc, exploit, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-Local-Privilege-Escalation.htmlx-refsource-misc, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/157110/SMBv3-Compression-Buffer-Overflow.htmlx-refsource-misc, exploit, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/157901/Microsoft-Windows-SMBGhost-Remote-Code-Execution.htmlx-refsource-misc, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/158054/SMBleed-SMBGhost-Pre-Authentication-Remote-Code-Execution-Proof-Of-Concept.htmlx-refsource-misc, third-party-advisory, vdb-entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0796us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.