boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Wednesday, October 7, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2020-1147

Microsoft .NET Framework, SharePoint, Visual Studio
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   N   R  U  H  H  H    7.8   .9397   99.8   YES
AFFECTED
  Product                                                                        Versions                                       Fixed
  Microsoft SharePoint Enterprise Server                                         2016 –                                         —
  Microsoft SharePoint Server                                                    2019 –                                         —
  Microsoft Visual Studio 2019                                                   16.0 –                                         —
  Microsoft Visual Studio 2019 version 16.6 (includes 16.0 - 16.5)               unspecified –                                  —
  Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)               unspecified –                                  —
  Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)               unspecified –                                  —
  .NET Core                                                                      2.1 –                                          —
  Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2                       Windows 7 for 32-bit Systems Service Pack 1 –  —
  Microsoft .NET Framework 4.8 on Windows 10 Version 1803 for 32-bit Systems     unspecified –                                  —
  Microsoft .NET Framework 4.8 on Windows 10 Version 1803 for x64-based Systems  unspecified –                                  —
  + 58 more
TIMELINE
  Nov 4   Reserved by microsoft
  Jul 14  Published (CNA: microsoft)
  Nov 3   Added to CISA KEV, remediation due 2022-05-03
CNA: microsoft · CVSS v3.1 · 6 references · KEV due May 3, 2022

Description

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
November 4, 2019ReservedReserved by microsoft
July 14, 2020PublishedPublished (CNA: microsoft)
November 3, 2021KEV ADDEDAdded to CISA KEV, remediation due 2022-05-03

Affected

Affected products and packages — 68 rows
VendorProduct / PackageEcosystemVersion introducedFixed
MicrosoftMicrosoft SharePoint Enterprise Server—2016—
MicrosoftMicrosoft SharePoint Server—2019—
MicrosoftMicrosoft Visual Studio 2019—16.0—
MicrosoftMicrosoft Visual Studio 2019 version 16.6 (includes 16.0 - 16.5)—unspecified—
MicrosoftMicrosoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)—unspecified—
MicrosoftMicrosoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)—unspecified—
Microsoft.NET Core—2.1—
MicrosoftMicrosoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2—Windows 7 for 32-bit Systems Service Pack 1—
MicrosoftMicrosoft .NET Framework 4.8 on Windows 10 Version 1803 for 32-bit Systems—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows 10 Version 1803 for x64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows Server, version 1803 (Server Core Installation)—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows 10 Version 1709 for 32-bit Systems—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows 10 Version 1709 for x64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows 10 Version 1607 for 32-bit Systems—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows 10 Version 1607 for x64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows Server 2016—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows Server 2016 (Server Core installation)—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows 7 for 32-bit Systems Service Pack 1—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows 7 for x64-based Systems Service Pack 1—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows 8.1 for 32-bit systems—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows 8.1 for x64-based systems—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows RT 8.1—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows Server 2012—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows Server 2012 (Server Core installation)—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows Server 2012 R2—unspecified—
MicrosoftMicrosoft .NET Framework 4.8 on Windows Server 2012 R2 (Server Core installation)—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for 32-bit Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for x64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows Server 2019—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows Server 2019 (Server Core installation)—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1909 for 32-bit Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1909 for x64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows Server, version 1909 (Server Core installation)—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for 32-bit Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for x64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows Server, version 1903 (Server Core installation)—1903—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1803 for 32-bit Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1803 for x64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.2 on Windows Server, version 1803 (Server Core Installation)—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for 32-bit Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for x64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for ARM64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019 (Server Core installation)—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 (Server Core installation)—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.1/4.7.2 on Windows 10 Version 1709 for 32-bit Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.1/4.7.2 on Windows 10 Version 1709 for x64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 4.6—Windows Server 2008 for 32-bit Systems Service Pack 2—
MicrosoftMicrosoft .NET Framework 2.0—Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2—
MicrosoftMicrosoft .NET Framework 3.0—Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2—
MicrosoftMicrosoft .NET Framework 3.5—Windows 8.1 for 32-bit systems—
MicrosoftMicrosoft .NET Framework 3.5.1—Windows 7 for 32-bit Systems Service Pack 1—
MicrosoftMicrosoft .NET Framework 4.5.2—Windows 7 for 32-bit Systems Service Pack 1—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 on Windows 10 for 32-bit Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 on Windows 10 for x64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.1/4.7.2 on Windows 10 Version 1709 for ARM64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1803 for ARM64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 2004 for x64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows Server, version 2004 (Server Core installation)—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1903 for ARM64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1909 for ARM64-based Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 2004 for 32-bit Systems—unspecified—
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 2004 for ARM64-based Systems—unspecified—

References (6)

Related

Authoritative record: CVE-2020-1147 at cve.org

Vendors: microsoft

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2020-1147 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, October 7, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.