Actively exploited in the wild

Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability

Microsoft - SQL Server · Listed in the CISA KEV since 2024-09-18. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVE-2020-0618

HighCVSS 8.8KEV

Published: 11/02/2020(UTC)Updated: 15/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

99.02%

100th percentile - higher than 100% of all known CVEs

Summary

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests.

Risk Assessment

An attacker can remotely execute arbitrary code on the server, potentially leading to full system compromise.

Recommendation

Apply the latest security updates for Microsoft SQL Server Reporting Services.

Original NVD description (English source)

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.