Live › vulnerability › CVE-2020-0618
Go to dashboardMicrosoft SQL Server Reporting Services has a deserialization flaw when handling page requests. An authenticated attacker can run code as the Report Server service account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft SQL Server | vendor | – | – |
| microsoft sql server | vendor | = 2012 | – |
| microsoft sql server | vendor | = 2014 | – |
| microsoft sql server | vendor | = 2016 | – |
Unknown from the sources.
Apply the Microsoft patch for CVE-2020-0618 or follow the vendor mitigation; CISA says to discontinue use if no mitigation exists.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2020-0618")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.