CVE-2020-1350

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.967 · 100 %ileexploit · PoCEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 15 exploits · PoC

Likely / severe?

96.7% (100th) EPSS

CVSS 10 · high

Is it mine?

38 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · fstec_bdu

added 2021-11-03remediate by 2022-05-03

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-27

Microsoft Windows DNS Server Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 10–10

v2.010highAV:N/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 10 · impact 10

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 6

v3.110criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 6

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-119USCWE-20US

exploits (15)

Public proof-of-concept and weaponised exploit code.

CVEmaster/CVE-2020-1350DNS Vulnerability - CVE-2020-1350PoC · poc_in_github
T13nn3s/CVE-2020-1350This Powershell Script is checking if your server is vulnerable for the CVE-2020-1350 Remote Code Execution flaw in the Windows DNS ServicePoC · poc_in_github
ZephrFish/CVE-2020-1350_HoneyPoCHoneyPoC: Proof-of-Concept (PoC) script to exploit SIGRed (CVE-2020-1350). Achieves Domain Admin on Domain Controllers running Windows Server 2000 up to Windows Server 2019.PoC · poc_in_github
captainGeech42/CVE-2020-1350Denial of Service PoC for CVE-2020-1350 (SIGRed)PoC · poc_in_github
connormcgarr/CVE-2020-1350CVE-2020-1350 Proof-of-ConceptPoC · poc_in_github
corelight/SIGRedDetection of attempts to exploit Microsoft Windows DNS server via CVE-2020-1350 (AKA SIGRed)PoC · poc_in_github

affected products (38)

Products and version ranges known to be affected.

Microsoft Windows Server≤ 2008 for x64-based Systems Service Pack 2enisa_euvdEU
Microsoft Windows Server≤ 2012 (Core installation)enisa_euvdEU
Microsoft Windows Server≤ 2008 for 32-bit Systems Service Pack 2enisa_euvdEU
Microsoft Windows Server≤ 2019 (Core installation)enisa_euvdEU
Microsoft Windows Server≤ 2012enisa_euvdEU
Microsoft Windows Server≤ 2016 (Core installation)enisa_euvdEU
Microsoft Windows Server≤ 2019enisa_euvdEU
Microsoft Windows Server≤ 2012 R2enisa_euvdEU
Microsoft Windows Server≤ 2008 R2 for x64-based Systems Service Pack 1enisa_euvdEU
Microsoft Windows Server≤ 2016enisa_euvdEU
Microsoft Windows Server≤ 2008 R2 for x64-based Systems Service Pack 1 (Core installation)enisa_euvdEU
Microsoft Windows Server≤ 2008 for x64-based Systems Service Pack 2 (Core installation)enisa_euvdEU
Microsoft Windows Server≤ 2012 R2 (Core installation)enisa_euvdEU
Microsoft Windows Server≤ 2008 for 32-bit Systems Service Pack 2 (Core installation)enisa_euvdEU
Microsoft Windows Server, version 1903 (Server Core installation)≤ unspecifiedenisa_euvdEU
Microsoft Windows Server, version 1909 (Server Core installation)≤ unspecifiedenisa_euvdEU
Microsoft Windows Server, version 2004 (Server Core installation)≤ unspecifiedenisa_euvdEU
Microsoft Corp Windows Server 1903 (Server Core Installation)all versionsfstec_bduRU
Microsoft Corp Windows Server 1909 (Server Core Installation)all versionsfstec_bduRU
Microsoft Corp Windows Server 2004 (Server Core Installation)all versionsfstec_bduRU

showing 20 of 38

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu NVD CVE.org MITRE

published 2020-07-14modified 2026-06-17

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan