CVE-2020-0688

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2020-0688 8.8

Microsoft · Exchange Server · Added 2021-11-03 · Published 2020-02-11

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityMicrosoft Exchange Server Validation Key Remote Code Execution Vulnerability

VendorMicrosoft

ProductExchange Server

Date added2021-11-03

Due date2022-05-03

CISA catalogView on CISA KEV catalog

Required actionApply updates per vendor instructions.

CWECWE-287

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.

NVD: A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-09-18 03:00 UTC

Wall time0.4s

Searches1

Component defaultyes

Sources https://github.com/Ridter/cve-2020-0688
https://github.com/Yt1g3r/CVE-2020-0688_EXP
https://github.com/zcgonvh/CVE-2020-0688
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0688
https://www.thezdi.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys

Hunting hypothesis agent

Hunt IIS W3SVC logs for authenticated low-priv POSTs to /ecp/default.aspx or /ecp/LiveIdError.aspx with oversized __VIEWSTATE and __VIEWSTATEGENERATOR=B97B4E27 values, plus w3wp.exe spawning cmd.exe or powershell.exe.

Research details

ComponentExchange Control Panel (ECP) ASP.NET ViewState handling - the machineKey ships with a static validationKey (CB2721ABDAF8E9DC..., HMAC-SHA1) shared by every deployment, so forged __VIEWSTATE passes signature checks and hits ObjectStateFormatter deserialization

PreconditionsAttacker needs a valid low-privileged account (any mailbox user, PR:L) and HTTPS reachability to the ECP virtual directory (443) on an affected unpatched server running Exchange Server 2010 SP3 RU30, 2013 CU23, 2016 CU14/CU15 or 2019 CU3/CU4 (fixed in the February 2020 updates); the static validationKey is present on every default install, and the attacker first fetches an ECP page to harvest its __VIEWSTATEGENERATOR value before POSTing the forged __VIEWSTATE. agent

DeliveryAuthenticated POST to an ECP page (e.g. /ecp/default.aspx with __VIEWSTATEGENERATOR=B97B4E27, or /ecp/LiveIdError.aspx) carrying a __VIEWSTATE signed with the public static validationKey and embedding a .NET deserialization gadget; code runs without user interaction.

Public PoCyes

PoC URLs https://github.com/zcgonvh/CVE-2020-0688
https://github.com/Ridter/cve-2020-0688
https://github.com/Yt1g3r/CVE-2020-0688_EXP Third-party repos; verify before use.

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0688

Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 7.0-8.9) | Fully weaponized: the HMAC-SHA1 validationKey is public and identical fleet-wide, so any valid mailbox credential converts to code execution under the ECP application pool (LocalSystem on default installs); PoCs: zcgonvh ExchangeCmd (C#), Ridter Python script, Yt1g3r EXP; also used post-exploitation for ASPX webshell drops

SummaryCVE-2020-0688 is a remote code execution in Exchange Control Panel caused by a static, install-independent ASP.NET machineKey: every deployment shares the same validationKey, so an authenticated low-privilege user can re-sign a malicious __VIEWSTATE and force ObjectStateFormatter deserialization on the server. Exploitation needs only valid mailbox credentials and HTTP access to /ecp/. Microsoft shipped the fix in the February 2020 updates; public PoCs (zcgonvh, Ridter, Yt1g3r) automate the ViewState forgery and command execution.

Tia coverage

First reported2026-09-16

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

nighteagle-targets-russian-companies

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.