Microsoft SMBv3 Remote Code Execution Vulnerability

CRÍTICO 10.0EXPLOITED (CISA KEV)CVE-2020-0796 · Published 12/03/2020 · updated 01/10/2026

Microsoft SMBv3 Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 10/02/2022. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.

En resumen

CVE-2020-0796 es una vulnerabilidad CRÍTICO (CVSS 10.0).
Explotada activamente: CISA la añadió al catálogo KEV el 10/02/2022.
Probabilidad de explotación en los próximos 30 días (EPSS): 99.8%, mayor que el 100.0% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
SMBv3 Microsoft	Versions not published yet (product named by CISA KEV)

Description

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

References

packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1-Proof-Of-Concept.html · Third Party Advisory
packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.html · Exploit
packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-Local-Privilege-Escalation.html · Third Party Advisory
packetstormsecurity.com/files/157110/SMBv3-Compression-Buffer-Overflow.html · Exploit
packetstormsecurity.com/files/157901/Microsoft-Windows-SMBGhost-Remote-Code-Execution.html · Third Party Advisory
packetstormsecurity.com/files/158054/SMBleed-SMBGhost-Pre-Authentication-Remote-Code-Execution-Proof-Of-Concept.html · Third Party Advisory
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796 · Patch
cisa.gov/known-exploited-vulnerabilities-catalog

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free