CVE-2020-0618 Microsoft SQL Server Reporting Services Remote Code Execution

Exploited in the wild Critical 9.8 Published 11 Feb 2020 Updated 15 Aug 2026

Remote attackers can execute arbitrary code on Microsoft SQL Server Reporting Services by exploiting a deserialization flaw in page request handling.

Exploited in the wild: Since 18 Sep 2024
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-0618?

CVE-2020-0618 is a critical unsafe deserialization vulnerability in Microsoft Sql Server, published on 11 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.

Weakness: CWE-502

Which versions are affected by CVE-2020-0618?

It affects 1 product.

Products include Microsoft Sql Server.

How do I fix CVE-2020-0618?

No fix has been published for CVE-2020-0618 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 9 Oct 2024.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2020-0618 being exploited?

Yes. Attackers have exploited CVE-2020-0618 in the wild since at least 18 Sep 2024, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 4 proofs of concept on GitHub.

All Microsoft Sql Server vulnerabilities

Sources

Also known as GHSA-jcvj-vhj2-vgmw.