9.8Critical KEV

CVE-2020-0646Microsoft .NET Framework Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2; Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2; Microsoft Microsoft .NET Framewor… Published: 2020-01-15 02:11 (6 years ago)

Known exploited — Microsoft .NET Framework Remote Code Execution Vulnerability

CISA confirmed this vulnerability is used in real attacks on 03.11.2021. Remediation deadline for US federal agencies: 03.05.2022.

Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-0646

Description

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.

Weakness (CWE): CWE-91

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Microsoft	Microsoft .NET Framework 3.0	Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2, Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2, Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2
Microsoft	Microsoft .NET Framework 3.5	Windows 10 Version 1607 for 32-bit Systems, Windows 8.1 for 32-bit systems, Windows 8.1 for x64-based systems, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)
Microsoft	Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit Systems	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based Systems	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 (Server Core installation)	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 on Windows 10 Version 1709 for 32-bit Systems	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 on Windows 10 Version 1709 for x64-based Systems	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 for 32-bit Systems	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 for x64-based Systems	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1803 for 32-bit Systems	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1803 for x64-based Systems	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for 32-bit Systems	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for x64-based Systems	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019 (Server Core installation)	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server, version 1803 (Server Core Installation)	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for 32-bit Systems	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for x64-based Systems	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for 32-bit Systems	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for x64-based Systems	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1909 for 32-bit Systems	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1909 for x64-based Systems	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019 (Server Core installation)	unspecified
Microsoft	Microsoft .NET Framework 3.5 AND 4.8 on Windows Server, version 1903 (Server Core installation)	1903
Microsoft	Microsoft .NET Framework 3.5 AND 4.8 on Windows Server, version 1909 (Server Core installation)	unspecified
Microsoft	Microsoft .NET Framework 3.5.1	Windows 7 for 32-bit Systems Service Pack 1, Windows 7 for x64-based Systems Service Pack 1, Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1, Windows Server 2008 R2 for x64-based Systems Service Pack 1, Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Microsoft	Microsoft .NET Framework 4.5.2	Windows 7 for 32-bit Systems Service Pack 1, Windows 7 for x64-based Systems Service Pack 1, Windows 8.1 for 32-bit systems, Windows 8.1 for x64-based systems, Windows RT 8.1, Windows Server 2008 for 32-bit Systems Service Pack 2, Windows Server 2008 for x64-based Systems Service Pack 2, Windows Server 2008 R2 for x64-based Systems Service Pack 1, Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)
Microsoft	Microsoft .NET Framework 4.6	Windows Server 2008 for 32-bit Systems Service Pack 2, Windows Server 2008 for x64-based Systems Service Pack 2
Microsoft	Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2	Windows 7 for 32-bit Systems Service Pack 1, Windows 7 for x64-based Systems Service Pack 1, Windows 8.1 for 32-bit systems, Windows 8.1 for x64-based systems, Windows RT 8.1, Windows Server 2008 R2 for x64-based Systems Service Pack 1, Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)
Microsoft	Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2	Windows 10 Version 1607 for 32-bit Systems
Microsoft	Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for 32-bit Systems	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for x64-based Systems	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows 10 Version 1709 for 32-bit Systems	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows 10 Version 1709 for x64-based Systems	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows 10 Version 1803 for 32-bit Systems	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows 10 Version 1803 for x64-based Systems	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows 7 for 32-bit Systems Service Pack 1	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows 7 for x64-based Systems Service Pack 1	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows 8.1 for 32-bit systems	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows 8.1 for x64-based systems	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows RT 8.1	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows Server 2012	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows Server 2012 R2	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows Server 2012 R2 (Server Core installation)	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows Server 2012 (Server Core installation)	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows Server 2016	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows Server 2016 (Server Core installation)	unspecified
Microsoft	Microsoft .NET Framework 4.8 on Windows Server, version 1803 (Server Core Installation)	unspecified
microsoft	.net framework	3.0

References and patches

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0646 PatchVendor Advisory
http://packetstormsecurity.com/files/156930/SharePoint-Workflows-XOML-Injection.html ExploitThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0646 US Government Resource

CPE matches (NVD) (28)

cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*

CVSS score

9.8Critical

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All scores (4)

CISA-ADP	CVSS 3.1	9.8Critical
nvd	CVSS 3.1	9.8Critical
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.8Critical
nvd	CVSS 2.0	10.0High

EPSS (chance of exploitation in 30 days)

99.22%

higher than 100% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: yes
Technical impact: total

Timeline

ID reserved2019-11-04
Published2020-01-15 02:11
Reached IP-DB2026-10-24 23:35
Added to KEV2021-11-03
Last updated2026-06-17 05:46

Assigned by (CNA): microsoft
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — .NET

5.3Medium

CVE-2026-120796 3 days ago

.NET Denial of Service Vulnerability

Microsoft .NET 11.0 installed on Linux; Microsoft .NET 11.0 installed on Mac OS; Microsoft .NET 11.0 installed on Windows; Microsoft System.Text.Json

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

1.2%EPSS

7.5High

CVE-2026-118749 3 days ago

ASP.NET Core Denial of Service Vulnerability

Microsoft .NET 11.0 installed on Linux; Microsoft .NET 11.0 installed on Mac OS; Microsoft .NET 11.0 installed on Windows; Microsoft Microsoft Visual Studio 2026 version 18.12

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

1.1%EPSS

7.5High

CVE-2026-118748 3 days ago

ASP.NET Core Denial of Service Vulnerability

Microsoft .NET 11.0 installed on Linux; Microsoft .NET 11.0 installed on Mac OS; Microsoft .NET 11.0 installed on Windows; Microsoft Microsoft Visual Studio 2026 version 18.12

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

1.1%EPSS

8.8High

CVE-2026-118745 3 days ago

Visual Studio Remote Code Execution Vulnerability

Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Windows; Microsoft .NET 8.0 installed on Windows; Microsoft .NET 9.0 installed on Windows

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

6.8Medium

CVE-2026-118746 3 days ago

.NET Security Feature Bypass Vulnerability

Microsoft .NET 11.0 installed on Linux; Microsoft .NET 11.0 installed on Mac OS

Not failing securely ('failing open') in .NET allows an unauthorized attacker to bypass a security feature over a network.

8.8High

CVE-2026-114159 3 days ago

Visual Studio Remote Code Execution Vulnerability

Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Windows; Microsoft .NET 8.0 installed on Windows; Microsoft .NET 9.0 installed on Windows

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.