Skip to content
OpenAdvisories
Critical · 9.8 Known exploited · Ransomware Scanner template Public exploit CVE-2020-0618 EUVD-2020-2113GHSA-jcvj-vhj2-vgmw

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Mic…

Published Feb 11, 2020 · Updated Aug 15, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Microsoft SQL Server Product: Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU) Product: Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR) Product: Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) Product: Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) Product: Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)

Description

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.

Affected products

VendorProductAffectedFixed
Microsoft Microsoft SQL Server 2012 for 32-bit Systems Service Pack 4 (QFE), 2012 for x64-based Systems Service Pack 4 (QFE), 2016 for x64-based Systems Service Pack 2 (CU) —
Microsoft Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) unspecified —
Microsoft Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) unspecified —
Microsoft Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) unspecified —
Microsoft Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR) unspecified —
Microsoft Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU) unspecified —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 1

GitHub 4 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References