SMBGhost (CVE-2020-0796)
Microsoft SMBv3 Remote Code Execution Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply updates per vendor instructions.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2020-0796
Also Known as SMBGhost
SMBGhost is the nickname for a flaw in SMBv3.1.1 compression handling in Windows 10 and Windows Server, versions 1903 and 1909, made public in March 2020 before a patch was available. Synacktiv notes it was also nicknamed CoronaBlue.
Other names: CoronaBlue
Description
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitation Context
as of October 15, 2026- CISA added CVE-2020-0796 to the KEV catalog 700 days after its CVE record was published.
- It is one of 391 Microsoft entries in the CISA KEV catalog, and one of 166 added in 2022.
- Its current EPSS score (99.8%) is higher than that of 91% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Microsoft Windows 10 Version 1903 for 32-bit Systems | unspecified |
| Microsoft | Microsoft Windows 10 Version 1903 for x64-based Systems | unspecified |
| Microsoft | Microsoft Windows 10 Version 1903 for ARM64-based Systems | unspecified |
| Microsoft | Microsoft Windows Server, version 1903 (Server Core installation) | unspecified |
| Microsoft | Microsoft Windows 10 Version 1909 for 32-bit Systems | unspecified |
| Microsoft | Microsoft Windows 10 Version 1909 for x64-based Systems | unspecified |
| Microsoft | Microsoft Windows 10 Version 1909 for ARM64-based Systems | unspecified |
| Microsoft | Microsoft Windows Server, version 1909 (Server Core installation) | unspecified |
References
7 Links- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796
- http://packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1-Proof-Of-Concept.html
- http://packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-Local-Privilege-Escalation.html
- http://packetstormsecurity.com/files/157110/SMBv3-Compression-Buffer-Overflow.html
- http://packetstormsecurity.com/files/157901/Microsoft-Windows-SMBGhost-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/158054/SMBleed-SMBGhost-Pre-Authentication-Remote-Code-Execution-Proof-Of-Concept.html
Record Details
More from Microsoft
Microsoft HTTP.sys Remote Code Execution Vulnerability
Microsoft Remote Desktop Services Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.