CVE-2020-0618

CVE-2020-0618 is a remote code execution flaw in Microsoft SQL Server Reporting Services (SSRS) caused by unsafe deserialization (CWE-502) of page-request/ViewState data submitted to a report server. An attacker with low-privilege (authenticated) access to a vulnerable SSRS instance can send a crafted serialized payload in a page request, with no user interaction, causing the server to deserialize attacker-controlled data and execute code. Successful exploitation yields remote code execution in the context of the SSRS service account, which is often highly privileged, enabling server compromise and lateral movement. Any organization running affected on-premises Microsoft SQL Server Reporting Services deployments is in scope. The flaw was patched in Microsoft's February 2020 Patch Tuesday, public PoCs have circulated since 2020, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-09-18 with known ransomware use and a near-certain EPSS score (99.0%), so exploitation in the wild is confirmed.

What to do: Apply the SQL Server/SSRS security updates released in Microsoft's February 2020 Patch Tuesday (or subsequent cumulative updates) per Microsoft's guidance, satisfying CISA's KEV required action. Inventory environments for SSRS deployments — prioritizing internet-facing report servers — and hunt for evidence of exploitation given the known ransomware use. Restrict network access to report servers and confirm the SSRS service account is not over-privileged to limit impact if exploited.