CVE-2020-0796

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

CVSS 3.1

10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-25)

CISA KEV

listed 2022-02-10, due 2022-08-10, known ransomware use

CWE

CWE-119

Published

2020-03-12

Modified

2026-10-01

Record from

the NVD, synced 2026-10-19

Affected

• microsoft:windows_10_1903
• microsoft:windows_10_1909
• microsoft:windows_server_1903
• microsoft:windows_server_1909

References

• http://packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1-Proof-Of-Concept.html
• http://packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-Local-Privilege-Escalation.html
• http://packetstormsecurity.com/files/157110/SMBv3-Compression-Buffer-Overflow.html
• http://packetstormsecurity.com/files/157901/Microsoft-Windows-SMBGhost-Remote-Code-Execution.html

Check your stackJSON