CVE-2020-0688

Netvigilance • October 11, 2026

CISA deadline 2022-05-03 · passed 4 years 5 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA

Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.

Microsoft Exchange Server . Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.

Weakness class: CWE-287.

2021-11-03 Added to CISA KEV Exploitation in the wild confirmed by CISA

2022-05-03 CISA remediation deadline passed 4 years 5 months ago

NVD entry for CVE-2020-0688 nvd.nist.gov/vuln/detail/CVE-2020-0688

CISA Known Exploited Vulnerabilities catalog

nvd.nist.gov nvd.nist.gov/vuln/detail/CVE-2020-0688

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.