CVE-2020-0618: Microsoft SQL Server Reporting Services ViewState deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, has a 99.9th percentile EPSS score, public exploit code, and yields remote code execution with high impact.

What it is

SQL Server Reporting Services mishandles page requests, allowing untrusted ViewState data to be deserialized (CWE-502). An authenticated attacker can send crafted requests to the SSRS endpoint and execute code in the service context, which is why this carries a CVSS 3.1 base score of 8.8 and is listed in CISA KEV.

Impact

Successful exploitation gives the attacker remote code execution on the SSRS host, with high impact to confidentiality, integrity and availability. Because SSRS often runs with elevated service privileges, compromise can extend to the underlying SQL Server and connected data.

Attack surface

Reachable over the network via the SSRS web endpoint (AV:N, AC:L). The vector requires low privileges (PR:L) and no user interaction (UI:N), so any authenticated account able to reach the reporting service is enough.

Exploitation

CISA added it to KEV on 2024-09-18 with a 2024-10-09 remediation due date and flags known ransomware campaign use; EPSS 30-day probability is 0.99022 (99.9th percentile). Public exploit code is referenced by Packet Storm advisories, so exploitation is both practical and observed.

What to do

• Apply the Microsoft security update for CVE-2020-0618 (portal.msrc.microsoft.com advisory) to all affected SQL Server Reporting Services instances.
• If patching is not immediately possible, follow CISA's required action: apply vendor mitigations or discontinue use of the product.
• Restrict network access to SSRS endpoints to trusted hosts and require strong authentication; do not expose the reporting service to the internet.
• Run the SSRS service account with least privilege and isolate it from high-value SQL Server and domain resources.
• Inventory all SSRS deployments, including legacy SQL Server 2016-era installs, so none are missed during remediation.

Detection

• Monitor SSRS web logs and IIS logs for anomalous POST requests to reporting endpoints, especially those with unusually large or malformed ViewState parameters.
• Alert on unexpected child processes spawned by the SSRS service (ReportingServicesService.exe), such as cmd.exe, powershell.exe or w3wp.exe children.
• Hunt for outbound connections or file writes originating from the SSRS host that do not match normal reporting traffic.
• Correlate authentication events against SSRS access to spot low-privileged accounts issuing unusual page requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.