CVE-2020-0796

Confirmed PUBLISHED

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests,...

Microsoft · Windows 10 Version 1903 for 32-bit Systems, Windows 10 Version 1903 for x64-based Systems, Windows 10 Version 1903 for ARM64-based Systems, Windows Server, version 1903 (Server Core installation), Windows 10 Version 1909 for 32-bit Systems, Windows 10 Version 1909 for x64-based Systems, Windows 10 Version 1909 for ARM64-based Systems, Windows Server, version 1909 (Server Core installation)

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

10.0 Critical

At a Glance

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

cisa ransomware metasploit windows microsoft nuclei_scanner malware

CVE Published: Mar 12, 2020
Exploitation Reported: Feb 10, 2022
CVSS: 10.0 Critical
EPSS: —

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Microsoft	Windows 10 Version 1903 for 32-bit Systems	unspecified	Affected
Microsoft	Windows 10 Version 1903 for x64-based Systems	unspecified	Affected
Microsoft	Windows 10 Version 1903 for ARM64-based Systems	unspecified	Affected
Microsoft	Windows Server, version 1903 (Server Core installation)	unspecified	Affected
Microsoft	Windows 10 Version 1909 for 32-bit Systems	unspecified	Affected
Microsoft	Windows 10 Version 1909 for x64-based Systems	unspecified	Affected
Microsoft	Windows 10 Version 1909 for ARM64-based Systems	unspecified	Affected
Microsoft	Windows Server, version 1909 (Server Core installation)	unspecified	Affected

CVE References

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796 portal.msrc.microsoft.com · CVE Record https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CV...
packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-W... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Micro...
packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Rem... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1...
packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-...
packetstormsecurity.com/files/157110/SMBv3-Compression-Buffer-Overfl... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/157110/SMBv3-Compression-Buffer-...

Show 2 more references

packetstormsecurity.com/files/157901/Microsoft-Windows-SMBGhost-Remo... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/157901/Microsoft-Windows-SMBGhos...
packetstormsecurity.com/files/158054/SMBleed-SMBGhost-Pre-Authentica... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/158054/SMBleed-SMBGhost-Pre-Auth...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2022-02-10 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2020/CVE-2020-0796.yaml	Jun 01, 2026
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/cve_2020_0796_smbghost.rb	Apr 29, 2025

CVSS Scores

CVSS v3.1 10.0 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0 7.5 High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitation Status

Exploited in the wild

Recorded 2022-02-10 00:00:00 UTC · CISA

Used in malware

Recorded 2022-02-10 00:00:00 UTC · CISA

Proof of concept available

Recorded 2020-03-10 21:40:57 UTC · GitHub

Weaknesses (CWE)

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2020/CVE-2020-0796.yaml	Jun 01, 2026
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/cve_2020_0796_smbghost.rb	Apr 29, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

madanokr001/CVE-2020-0796

github · Created 2025-04-19 05:29:17 UTC · 1 stars

monjheta/CVE-2020-0796

github · Created 2025-02-26 04:14:32 UTC · 0 stars

Kaizzzo1/CVE-2020-0796

github · Created 2025-01-29 08:52:02 UTC · 1 stars

dungnm24/CVE-2020-0796

github · Created 2023-05-29 06:31:51 UTC · 6 stars

WindowsProtocolTestSuites is to trigger BSoD, and full exploit poc.

krizzz07/CVE-2020-0796

github · Created 2023-01-29 04:29:49 UTC · 0 stars

windows 10 SMB vulnerability

SEHandler/CVE-2020-0796

github · Created 2022-11-09 13:46:24 UTC · 1 stars

CVE-2020-0796

arzuozkan/CVE-2020-0796

github · Created 2022-06-07 17:16:16 UTC · 1 stars

CVE-2020-0796 explanation and researching vulnerability for term porject CENG325

orangmuda/CVE-2020-0796

github · Created 2021-10-09 04:52:55 UTC · 4 stars

Remote Code Execution POC for CVE-2020-0796

Anonimo501/SMBGhost_CVE-2020-0796_checker

github · Created 2021-09-04 15:07:15 UTC · 2 stars

MasterSploit/LPE---CVE-2020-0796

github · Created 2020-11-20 09:00:08 UTC · 2 stars

codewithpradhan/SMBGhost-CVE-2020-0796-

github · Created 2020-09-28 05:23:20 UTC · 2 stars

To crash Windows-10 easily

rsmudge/CVE-2020-0796-BOF

github · Created 2020-09-17 01:48:37 UTC · 70 stars

exp-sky/CVE-2020-0796

github · Created 2020-06-09 06:18:54 UTC · 3 stars

SMBv3 Ghost (CVE-2020-0796) Vulnerability

ysyyrps123/CVE-2020-0796

github · Created 2020-06-02 12:04:30 UTC · 0 stars

CVE-2020-0796

halsten/CVE-2020-0796

github · Created 2020-05-28 08:41:12 UTC · 0 stars

syadg123/CVE-2020-0796

github · Created 2020-04-22 09:10:15 UTC · 2 stars

thelostworldFree/CVE-2020-0796

github · Created 2020-04-22 09:09:02 UTC · 11 stars

PoC RCE Reverse Shell for CVE-2020-0796 (SMBGhost)

jamf/CVE-2020-0796-RCE-POC

github · Created 2020-04-20 14:35:48 UTC · 553 stars

CVE-2020-0796 Remote Code Execution POC

LabDookhtegan/CVE-2020-0796-EXP

github · Created 2020-04-02 15:32:10 UTC · 1 stars

CVE-2020-0796-EXP

eastmountyxz/CVE-2020-0796-SMB

github · Created 2020-04-02 12:12:03 UTC · 33 stars

该资源为CVE-2020-0796漏洞复现，包括Python版本和C++版本。主要是集合了github大神们的资源，希望您喜欢~

jiansiting/CVE-2020-0796

github · Created 2020-04-01 01:46:08 UTC · 62 stars

tango-j/CVE-2020-0796

github · Created 2020-03-31 19:01:52 UTC · 4 stars

Coronablue exploit

f1tz/CVE-2020-0796-LPE-EXP

github · Created 2020-03-31 11:25:50 UTC · 17 stars

Windows SMBv3 LPE exploit 已编译版

TinToSer/CVE-2020-0796-LPE

github · Created 2020-03-31 05:41:30 UTC · 2 stars

SMBGHOST local privilege escalation

jamf/CVE-2020-0796-LPE-POC

github · Created 2020-03-30 16:06:50 UTC · 241 stars

CVE-2020-0796 Local Privilege Escalation POC

danigargu/CVE-2020-0796

github · Created 2020-03-30 11:42:56 UTC · 1318 stars

CVE-2020-0796 - Windows SMBv3 LPE exploit #SMBGhost

cory-zajicek/CVE-2020-0796-DoS

github · Created 2020-03-21 18:17:10 UTC · 1 stars

DoS PoC for CVE-2020-0796 (SMBGhost)

julixsalas/CVE-2020-0796

github · Created 2020-03-16 15:39:22 UTC · 1 stars

Scanner for CVE-2020-0796

ran-sama/CVE-2020-0796

github · Created 2020-03-16 00:47:41 UTC · 1 stars

Lightweight PoC and Scanner for CVE-2020-0796 without authentication.

maxpl0it/Unauthenticated-CVE-2020-0796-PoC

github · Created 2020-03-15 22:17:50 UTC · 21 stars

An unauthenticated PoC for CVE-2020-0796

jiansiting/CVE-2020-0796-Scanner

github · Created 2020-03-15 03:17:47 UTC · 9 stars

CVE-2020-0796-Scanner

GuoKerS/aioScan_CVE-2020-0796

github · Created 2020-03-14 23:39:25 UTC · 16 stars

基于asyncio（协程）的CVE-2020-0796 速度还是十分可观的，方便运维师傅们对内网做下快速检测。

wsfengfan/CVE-2020-0796

github · Created 2020-03-14 05:39:37 UTC · 0 stars

CVE-2020-0796 Python POC buffer overflow

vysecurity/CVE-2020-0796

github · Created 2020-03-13 08:34:31 UTC · 5 stars

CVE-2020-0796 - Working PoC - 20200313

laolisafe/CVE-2020-0796

github · Created 2020-03-12 19:46:25 UTC · 2 stars

SMBv3 RCE vulnerability in SMBv3

eerykitty/CVE-2020-0796-PoC

github · Created 2020-03-12 18:34:40 UTC · 327 stars

PoC for triggering buffer overflow via CVE-2020-0796

xax007/CVE-2020-0796-Scanner

github · Created 2020-03-12 15:36:43 UTC · 0 stars

CVE-2020-0796 SMBv3.1.1 Compression Capability Vulnerability Scanner

kn6869610/CVE-2020-0796

github · Created 2020-03-12 02:47:49 UTC · 0 stars

joaozietolie/CVE-2020-0796-Checker

github · Created 2020-03-11 16:23:03 UTC · 14 stars

Script that checks if the system is vulnerable to CVE-2020-0796 (SMB v3.1.1)

T13nn3s/CVE-2020-0796

github · Created 2020-03-11 09:13:48 UTC · 28 stars

Powershell SMBv3 Compression checker

0x25bit/CVE-2020-0796-PoC

github · Created 2020-03-10 21:40:57 UTC · 19 stars

Weaponized PoC for SMBv3 TCP codec/compression vulnerability

Microsoft SMBv3 - Remote Code Execution

nuclei · Created Unknown

cve_2020_0796_smbghost

metasploit · Created Unknown

Metasploit module for CVE-2020-0796

cve_2020_0796_smbghost

metasploit · Created Unknown

Metasploit module for CVE-2020-0796

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2020-0796

{
  "cve_id": "CVE-2020-0796",
  "title": "A remote code execution vulnerability exists in the way that the Microsoft Se...",
  "affected_vendor": "Microsoft",
  "affected_product": "Windows 10 Version 1903 for 32-bit Systems, Windows 10 Version 1903 for x64-based Systems, Windows 10 Version 1903 for ARM64-based Systems, Windows Server, version 1903 (Server Core installation), Windows 10 Version 1909 for 32-bit Systems, Windows 10 Version 1909 for x64-based Systems, Windows 10 Version 1909 for ARM64-based Systems, Windows Server, version 1909 (Server Core installation)",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 10.0,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2020-0796

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API