CVE-2020-0646Known exploitationPublic exploitNetwork attack vector

Remote code execution via unescaped XOML attribute

Published Jan 14, 2020 · Updated Oct 21, 2025

Code injection in Microsoft .NET Framework allows remote attackers to execute arbitrary code through crafted XOML workflow markup. During XOML compilation, the workflow generator inserts the CallExternalMethodActivity InterfaceType attribute into temporary C# source without restricting metacharacters, allowing the attribute to escape its assignment. A reachable workflow-compilation endpoint and crafted XOML are required; injected code runs with the hosting process's rights and can take control of the affected system.

CVSS severity9.8

Critical

EPSS probability99.22%

Next 30 days · Sep 16, 2026

Known exploitationReported

Based on sourced intelligence

Hinoki checkNot available

Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

The record

CVE: CVE-2020-0646
Published: Jan 14, 2020
Updated: Oct 21, 2025

Vendor: Microsoft
Product: Microsoft .NET Framework 4.6
Classifications: CWE-91, T1190

Attack vector: network
Privileges: unauthenticated

Timeline

How it unfolded

Jan 14, 2020CVE publishedPublication date reported by the CVE source.
Oct 21, 2025Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

Affected versionversion=Windows Server 2008 for 32-bit Systems Service Pack 2
Affected versionversion=Windows Server 2008 for x64-based Systems Service Pack 2

What conditions does exploitation require?

Attack vectornetwork

Required privilegesunauthenticated

What is affected?

Microsoft · Microsoft .NET Framework 4.6version=Windows Server 2008 for 32-bit Systems Service Pack 2; version=Windows Server 2008 for x64-based Systems Service Pack 2

Microsoft · Microsoft .NET Framework 4.5.2version=Windows 7 for 32-bit Systems Service Pack 1; version=Windows 7 for x64-based Systems Service Pack 1; version=Windows 8.1 for 32-bit systems; version=Windows 8.1 for x64-based systems; version=Windows RT 8.1; version=Windows Server 2008 for 32-bit Systems Service Pack 2; version=Windows Server 2008 for x64-based Systems Service Pack 2; version=Windows Server 2008 R2 for x64-based Systems Service Pack 1; version=Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation); version=Windows Server 2012; version=Windows Server 2012 R2; version=Windows Server 2012 R2 (Server Core installation); version=Windows Server 2012 (Server Core installation)

Microsoft · Microsoft .NET Framework 3.5.1version=Windows 7 for 32-bit Systems Service Pack 1; version=Windows 7 for x64-based Systems Service Pack 1; version=Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1; version=Windows Server 2008 R2 for x64-based Systems Service Pack 1; version=Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Microsoft · Microsoft .NET Frameworkversion=1903; version=Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2; version=Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2; version=Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2; version=unspecified; version=Windows 10 Version 1607 for 32-bit Systems; version=Windows 7 for 32-bit Systems Service Pack 1; version=Windows 7 for x64-based Systems Service Pack 1; version=Windows 8.1 for 32-bit systems; version=Windows 8.1 for x64-based systems; version=Windows RT 8.1; version=Windows Server 2008 R2 for x64-based Systems Service Pack 1; version=Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation); version=Windows Server 2012; version=Windows Server 2012 R2; version=Windows Server 2012 R2 (Server Core installation); version=Windows Server 2012 (Server Core installation)

Microsoft · Microsoft .NET Framework 3.5version=Windows 10 Version 1607 for 32-bit Systems; version=Windows 8.1 for 32-bit systems; version=Windows 8.1 for x64-based systems; version=Windows Server 2012; version=Windows Server 2012 R2; version=Windows Server 2012 R2 (Server Core installation); version=Windows Server 2012 (Server Core installation)

Published CVSS scores

9.8NIST NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10.0NIST NVDAV:N/AC:L/Au:N/C:C/I:C/A:C

9.8CISACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 10, 2026Sep 16, 2026

Latest reporting daySep 16, 2026

Latest daily unique IPsUnavailable

Prior 30-day averageUnavailable

SourceShadowserver honeypots (KEV)

Vectornetwork

Privilegesunauthenticated

Known exploitationReported

Public exploitPublished

Weakness, pattern, technique

CWE-91XML Injection (aka Blind XPath Injection)

T1190Exploit Public-Facing Application

Public exploit references

SharePoint Workflows XOML Injection Metasploit modulefunctional · demonstrated

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Reported exploitation

CISA Known Exploited Vulnerabilities listingknown exploited catalog

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo