CVE-2020-1181: Microsoft SharePoint Server unsafe web control remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityNetwork-reachable authenticated remote code execution with full CIA impact and a very high EPSS score, though no KEV listing or documented in-the-wild exploitation.

What it is

SharePoint Server fails to properly identify and filter unsafe ASP.NET web controls, allowing an authenticated user to execute code on the server. Because SharePoint is widely deployed for collaboration and the flaw yields full server compromise, it is a serious risk for any unpatched farm.

Impact

An attacker gains remote code execution in the SharePoint server context, with high impact to confidentiality, integrity and availability of the host and its data.

Attack surface

Reached over the network via the SharePoint web interface; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N), so any authenticated low-privileged user can attempt it.

Exploitation

Not listed in CISA KEV and no ransomware use documented; EPSS is high at 0.693 (99.3rd percentile), and references are patch and advisory only, with no public exploit tag.

What to do

• Apply the Microsoft security update for CVE-2020-1181 to all affected SharePoint Server, Enterprise Server and Foundation installations.
• Restrict and audit site creation and web part/page editing permissions so low-privileged users cannot upload or configure unsafe controls.
• Enable and monitor SharePoint unified audit logging and server-side ASP.NET error logging for control-related failures.
• Segment SharePoint servers from sensitive internal networks and limit outbound traffic to reduce post-exploitation reach.

Detection

• Hunt for w3wp.exe spawning child processes such as cmd.exe, powershell.exe or net.exe on SharePoint hosts.
• Review IIS and SharePoint logs for requests that upload or reference unusual ASP.NET controls or web parts.
• Alert on new or modified .aspx/.ascx files and web.config changes in SharePoint web directories.
• Correlate low-privileged SharePoint accounts with anomalous server-side process creation or file writes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.