Summary
generated automatically from NVD dataCVE-2020-1350 affects the Windows DNS Server role on Microsoft Windows Server 2008 R2, 2012 R2, 2016 and 2019. The server fails to properly handle requests (improper input validation, CWE-20), which lets a remote attacker execute arbitrary code over the network without authentication or user interaction. It is rated CVSS 10.0 (CRITICAL) and is listed in the CISA KEV catalog, meaning it is actively exploited.
NVD description
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2022-05-03
EPSS · FIRST.org
96.7%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 14 juil. 2020
- Updated
- 17 juin 2026
- Status
- Analyzed
- Source
- secure@microsoft.com
Affected products
Weaknesses (CWE)
References (5)
- http://packetstormsecurity.com/files/158484/SIGRed-Windows-DNS-Denial-Of-Service.htmlThird Party AdvisoryVDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350PatchVendor Advisory
- http://packetstormsecurity.com/files/158484/SIGRed-Windows-DNS-Denial-Of-Service.htmlThird Party AdvisoryVDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350PatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1350US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-20
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.