8.8 High Exploited · ransomware

CVE-2020-0688 Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Known to be used

Weakness CWE-287

Description

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

Affected products and versions

Product	Affected versions	Fixed in
Microsoft Exchange Server 2013	Versions not published
Microsoft Exchange Server 2019 Cumulative Update 3	Versions not published
Microsoft Exchange Server 2016 Cumulative Update 14	Versions not published
Microsoft Exchange Server 2016 Cumulative Update 15	Versions not published
Microsoft Exchange Server 2019 Cumulative Update 4	Versions not published
Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30	Versions not published

References

portal.msrc.microsoft.com portal.msrc.microsoft.com
www.zerodayinitiative.com www.zerodayinitiative.com
packetstormsecurity.com packetstormsecurity.com
packetstormsecurity.com packetstormsecurity.com

Timeline

Published February 11, 2020
Added to the KEV catalogue November 3, 2021
Last modified October 21, 2025

The 10 CVEs of Microsoft Exchange Server 2013 →

CVE-2020-0692 An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of… Not rated CVE-2019-1373 A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via… Not rated CVE-2019-1137 A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a… Not rated CVE-2019-1136 An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of… Not rated

Track this CVE