---
id: "CVE-2020-1147"
kind: "vulnerability"
aliases: ["CVE-2020-1147"]
title: "Microsoft .NET Framework, SharePoint, Visual Studio: Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability"
severity: "critical"
cvss: 7.8
epss: 0.93966
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Microsoft .NET Framework, SharePoint, Visual Studio", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["dotnet", "exploited", "runtime", "sharepoint", "visual-studio", "windows"]
not_affected_if: ["patched-systems"]
published_at: "2020-07-14T23:15:12+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1147", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-1147", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1147", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# Microsoft .NET Framework, SharePoint, Visual Studio: Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability

Microsoft .NET Framework, SharePoint, and Visual Studio fail to check the source markup of XML input during deserialization. An attacker who supplies crafted XML can run code in the context of the process that deserializes it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft .NET Framework, SharePoint, Visual Studio affected ? fixed ?

## Fix

Apply the Microsoft security updates for .NET Framework, SharePoint and Visual Studio per vendor instructions (CISA required action). Specific patched versions: unknown

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1147
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-1147
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-1147

## From the sources

Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_