Microsoft SMBv3 Remote Code Execution Vulnerability

CRITICAL 10.0EXPLOITED (CISA KEV)CVE-2020-0796 · Published 12/03/2020 · updated 01/10/2026

Microsoft SMBv3 Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 10/02/2022. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.

Package	Affected versions	Patched versions
SMBv3 Microsoft	Versions not published yet (product named by CISA KEV)

Description

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

References

packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1-Proof-Of-Concept.html · Third Party Advisory
packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.html · Exploit
packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-Local-Privilege-Escalation.html · Third Party Advisory
packetstormsecurity.com/files/157110/SMBv3-Compression-Buffer-Overflow.html · Exploit
packetstormsecurity.com/files/157901/Microsoft-Windows-SMBGhost-Remote-Code-Execution.html · Third Party Advisory
packetstormsecurity.com/files/158054/SMBleed-SMBGhost-Pre-Authentication-Remote-Code-Execution-Proof-Of-Concept.html · Third Party Advisory
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796 · Patch
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2020-0796

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free