CVE-2020-0618

Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability

Microsoft — SQL Server

Added to KEV catalog: 18 September 2024
Federal remediation due date: 9 October 2024
Weakness classification (CWE): CWE-502

CISA Description

Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-0618 ; https://nvd.nist.gov/vuln/detail/CVE-2020-0618

View on NVD View on MITRE CVE View full CISA catalog

More Microsoft Vulnerabilities

CVE-2026-45659

Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

CVE-2008-4250

Microsoft Windows Buffer Overflow Vulnerability

CVE-2009-1537

Microsoft DirectX NULL Byte Overwrite Vulnerability

CVE-2010-0249

Microsoft Internet Explorer Use-After-Free Vulnerability

CVE-2010-0806

Microsoft Internet Explorer Use-After-Free Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services