# CVE-2020-0688: Microsoft Exchange Server - RCE

> Live exploitation tracking for CVE-2020-0688 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2020-0688

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.8
- **Public exploit available:** Yes
- **Affected products:** Microsoft Exchange Server 2013, Microsoft Exchange Server 2019 Cumulative Update 3, Microsoft Exchange Server 2016 Cumulative Update 14, Microsoft Exchange Server 2016 Cumulative Update 15, Microsoft Exchange Server 2019 Cumulative Update 4, Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30
- **Weaknesses:** CWE-287 (Improper Authentication)
- **Tags:** windows, enterprise_software

## Description

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

## CrowdSec analysis

[CVE-2020-0688](https://euvd.enisa.europa.eu/vulnerability/CVE-2020-0688) is a remote code execution vulnerability in multiple versions of Microsoft Exchange Server, stemming from improper handling of objects in memory. Exploitation of this flaw allows authenticated attackers to execute arbitrary code on the affected server, potentially leading to full system compromise, data theft, or further lateral movement within the network. This vulnerability poses a significant risk to organizations relying on Microsoft Exchange for email and collaboration.

CrowdSec has been tracking this vulnerability and its exploits since 24th of July 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2020-0688 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit Microsoft Exchange by sending crafted requests to `/ecp/default.aspx` with malicious `__VIEWSTATE` and `__VIEWSTATEGENERATOR` parameters, enabling remote code execution via deserialization.

## Timeline

- 2020-02-11: CVE Published. CVE-2020-0688 is published to NVD.
- 2021-11-03: CISA KEV. CVE-2020-0688 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2022-05-03: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2025-07-24: Rule Released. CrowdSec releases a rule to detect CVE-2020-0688 exploitation attempts against the CrowdSec Network.

## References

- https://www.zerodayinitiative.com/advisories/ZDI-20-258/
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688
- http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html
- https://github.com/rix4uni/cvemapping/blob/main/2020/CVE-2020-0688/cve-2020-0688.py

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2020-0688) follows observed exploitation activity for CVE-2020-0688. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.