{"id":"CVE-2020-0796","kind":"vulnerability","aliases":["CVE-2020-0796"],"related":[],"title":"Microsoft SMBv3: Microsoft SMBv3 Remote Code Execution Vulnerability","description":"A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Microsoft's SMBv3 file-sharing protocol mishandles certain requests, so a remote attacker can run code on the target server or client. CISA lists it as actively exploited in the wild, and EPSS puts exploitation likelihood at 0.998.","severity":"critical","cvss":10.0,"epss":0.9981,"exploited":true,"exploited_at":"2022-02-10T00:00:00+00:00","products":[{"name":"Microsoft SMBv3","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","file-servers","infrastructure","ransomware","smb","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the Microsoft updates for CVE-2020-0796 per vendor instructions (CISA required action).","status":"open","published_at":"2020-03-12T16:15:15+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:28:51+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:28:51Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft updates for CVE-2020-0796 per vendor instructions (CISA required action).\nunknown","reach":"network","impact":"high","summary":"Microsoft's SMBv3 file-sharing protocol mishandles certain requests, so a remote attacker can run code on the target server or client. CISA lists it as actively exploited in the wild, and EPSS puts exploitation likelihood at 0.998.","category":"infrastructure","who_cares":["windows","smb","file-servers"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code remotely on a Windows SMBv3 server or client","analyst_note":"Find the vendor advisory and the specific patched builds and any SMBv3 compression disable workaround at the Microsoft Security Response Center entry for CVE-2020-0796, plus a reliable check command, since the sources give neither.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000479,"input_tokens":2878,"output_tokens":383,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0796':11A,14A '-2020':10A,13A '0.998':63B '3.1.1':79C 'abil':95C 'action':107C 'activ':52B 'appli':108C 'attack':38B,86C 'block':78C 'certain':33B,83C 'cisa':48B,105C 'client':47B,104C 'code':6A,41B,66C,98C 'could':92C 'cve':9A,12A 'epss':58B 'execut':7A,67C,97C 'exist':69C 'exploit':17B,53B,60B,89C 'file':19B,29B 'file-serv':18B 'file-shar':28B 'gain':93C 'handl':82C 'infrastructur':21B 'instruct':112C 'likelihood':61B 'list':49B 'messag':77C 'microsoft':1A,3A,15A,25B,75C 'mishandl':32B 'per':110C 'protocol':31B,81C 'put':59B 'ransomwar':22B 'remot':5A,37B,65C 'request':34B,84C 'requir':106C 'run':40B 'server':20B,45B,76C,102C 'share':30B 'smb':23B 'smbv3':2A,4A,16A,27B,80C 'success':88C 'target':44B,101C 'updat':109C 'vendor':111C 'vulner':8A,68C,91C 'way':72C 'wild':56B 'window':24B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-03-12T16:15:15+00:00","kev":{"dateAdded":"2022-02-10","dueDate":"2022-08-10","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-0796","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0796","severity":null,"published_at":"2022-02-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T15:39:43+00:00","note":null},{"source":"epss","external_id":"CVE-2020-0796","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-0796","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-0796","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-0796","severity":null,"published_at":"2020-03-12T16:15:15+00:00","modified_at":"2026-10-01T20:17:17+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}