CVE-2020-0655: Windows Remote Desktop Services clipboard redirection remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.0 and a 99th-percentile EPSS score indicate serious risk, though exploitation requires authenticated access and user interaction and no KEV listing exists.

What it is

CVE-2020-0655 is a remote code execution flaw in Microsoft Remote Desktop Services (formerly Terminal Services) triggered when an authenticated attacker abuses clipboard redirection. It affects a broad set of Windows client and server releases, so any environment exposing RDP with clipboard redirection enabled carries risk.

Impact

A successful attacker can execute code on the target system with the privileges of the abused session, giving full compromise of confidentiality, integrity and availability per the CVSS vector. The attacker must already hold valid credentials and rely on some user interaction.

Attack surface

Reached over the network via RDP (AV:N) with low attack complexity, but requires low privileges (PR:L) and user interaction (UI:R), meaning the attacker needs an authenticated session and a victim action involving clipboard redirection. No unauthenticated path is described.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is high at roughly 0.657 (99.2nd percentile), indicating elevated predicted exploitation likelihood. The only references are Microsoft patch and vendor advisory links, with no public exploit or PoC tags.

What to do

• Apply the Microsoft security update for CVE-2020-0655 on all affected Windows client and server versions.
• Disable or restrict RDP clipboard redirection where it is not operationally required.
• Limit RDP exposure to trusted networks and require strong authentication, such as MFA, for remote sessions.
• Restrict and monitor which accounts are permitted to establish RDP sessions to sensitive hosts.

Detection

• Monitor RDP session logs for clipboard redirection activity, especially from unusual or low-privilege accounts.
• Alert on unexpected process creation or child processes spawned within RDP sessions on servers.
• Correlate RDP logon events with subsequent suspicious process or file activity on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.