Skip to content
OpenAdvisories
High · 8.8 Known exploited · Ransomware Public exploit CVE-2020-0688 EUVD-2020-2181GHSA-4g56-8mc7-hpjq

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, a…

Published Feb 11, 2020 · Updated Oct 21, 2025 · Assigned by microsoft

Vendor: Microsoft Product: Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30 Product: Microsoft Exchange Server 2013 Product: Microsoft Exchange Server 2016 Cumulative Update 14 Product: Microsoft Exchange Server 2016 Cumulative Update 15 Product: Microsoft Exchange Server 2019 Cumulative Update 3 Product: Microsoft Exchange Server 2019 Cumulative Update 4

Description

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

Affected products

VendorProductAffectedFixed
Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 —
Microsoft Microsoft Exchange Server 2019 Cumulative Update 3 unspecified —
Microsoft Microsoft Exchange Server 2016 Cumulative Update 14 unspecified —
Microsoft Microsoft Exchange Server 2016 Cumulative Update 15 unspecified —
Microsoft Microsoft Exchange Server 2019 Cumulative Update 4 unspecified —
Microsoft Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30 unspecified —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 2

GitHub 25 repositories · most starred shown

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References