Microsoft Exchange Server - RCE (CVE-2020-0688)
Description
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
psychologyCrowdSec Analysis
CVE-2020-0688 is a remote code execution vulnerability in multiple versions of Microsoft Exchange Server, stemming from improper handling of objects in memory. Exploitation of this flaw allows authenticated attackers to execute arbitrary code on the affected server, potentially leading to full system compromise, data theft, or further lateral movement within the network. This vulnerability poses a significant risk to organizations relying on Microsoft Exchange for email and collaboration.
CrowdSec has been tracking this vulnerability and its exploits since 24th of July 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2020-0688 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit Microsoft Exchange by sending crafted requests to /ecp/default.aspx with malicious __VIEWSTATE and __VIEWSTATEGENERATOR parameters, enabling remote code execution via deserialization.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2020-02-11 |
| CISA KEV | 2021-11-03 |
| CISA Remediation Deadline | 2022-05-03 |
| Rule Released | 2025-07-24 |
Remediation & Protection
External References
- https://www.zerodayinitiative.com/advisories/ZDI-20-258/
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688
- http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html
- https://github.com/rix4uni/cvemapping/blob/main/2020/CVE-2020-0688/cve-2020-0688.py