boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2020-0618HIGH
Microsoft SQL Server
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .9902   99.9   YES
AFFECTED
  Product                                                               Versions                                        Fixed
  Microsoft SQL Server                                                  2012 for 32-bit Systems Service Pack 4 (QFE) –  —
  Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)  unspecified –                                   —
  Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)   unspecified –                                   —
  Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)  unspecified –                                   —
  Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)     unspecified –                                   —
  Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)      unspecified –                                   —
TIMELINE
  Nov 4   Reserved by microsoft
  Sep 18  Added to CISA KEV, remediation due 2024-10-09
  Sep 18  Published (CNA: microsoft)
  Aug 15  EXPLOIT PUBLISHED — CVE-2020-0618 (Microsoft SQL Server). Public exploit reference added.
  Aug 15  RESCORED — CVE-2020-0618 (Microsoft SQL Server). CVSS 9.8 → 8.8 (NVD).
CWE-502 · CNA: microsoft · CVSS v3.1 · 4 references · NVD status: Analyzed · KEV due October 9, 2024

Description

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.

Lifecycle

Complete event history — 5 events, chronological
DateEventDetail
November 4, 2019ReservedReserved by microsoft
September 18, 2024KEV ADDEDAdded to CISA KEV, remediation due 2024-10-09
September 18, 2024PublishedPublished (CNA: microsoft)
August 15, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2020-0618 (Microsoft SQL Server). Public exploit reference added.
August 15, 2026RESCOREDRESCORED — CVE-2020-0618 (Microsoft SQL Server). CVSS 9.8 → 8.8 (NVD).

Affected

Affected products and packages — 6 rows
VendorProduct / PackageEcosystemVersion introducedFixed
MicrosoftMicrosoft SQL Server—2012 for 32-bit Systems Service Pack 4 (QFE)—
MicrosoftMicrosoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)—unspecified—
MicrosoftMicrosoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)—unspecified—
MicrosoftMicrosoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)—unspecified—
MicrosoftMicrosoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)—unspecified—
MicrosoftMicrosoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)—unspecified—

Weaknesses

CWE-502

References (4)

Related

Authoritative record: CVE-2020-0618 at cve.org

Vendors: microsoft

Weaknesses: CWE-502

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2020-0618 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.