Skip to content
Fencer Vulns
high 8.6

CVE-2020-16952 in the critical feed json

Microsoft SharePoint Remote Code Execution Vulnerability

published 2020-10-16 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-8910

cvss
8.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
71.1%
EPSS 71.1% chance of exploitation in 30 days, percentile 99.4%
public exploits
1
Metasploit, plus a Nuclei check

Summary

<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.</p> <p>Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint.</p> <p>The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages.</p>

Patch / fix

Timeline

  1. First public exploit (Metasploit exploit/windows/http/sharepoint_ssi_viewstate)
  2. Published

Exploit prediction

71.09% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CNA 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L/E:P/RL:O/RC:C
CNA 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • Microsoft Microsoft SharePoint Enterprise Server 2016
  • Microsoft Microsoft SharePoint Server 2019
  • Microsoft Microsoft SharePoint Foundation 2013 Service Pack 1

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.