CVE-2020-0796

ENISA EUVD: EUVD-2020-2283 ↗
Exploited in the Wild ✓ Confirmed 0-Day
Triaged: March 5, 2026 7 articles Published: 2020-03-12

EPSS Score

Source: FIRST.org · 2026-05-23
94.42%
probability
This CVE has a 94.42% probability of being exploited in the next 30 days.
0% Top 100.0th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)
10
CRITICAL
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v2 (legacy)

7.5
HIGH
Access Vector
Network
Access Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

VulnerabilityLookup (CNA)
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

Affected Products

Microsoft
Windows 10 Version 1903 for 32-bit Systems
unspecified
Microsoft
Windows 10 Version 1903 for x64-based Systems
unspecified
Microsoft
Windows 10 Version 1903 for ARM64-based Systems
unspecified
Microsoft
Windows Server, version 1903 (Server Core installation)
unspecified
Microsoft
Windows 10 Version 1909 for 32-bit Systems
unspecified

Attack Intelligence

Exploits & PoC

danigargu/CVE-2020-0796

CVE-2020-0796 - Windows SMBv3 LPE exploit #SMBGhost

1354 2020-12-07
ly4k/SMBGhost

Scanner for CVE-2020-0796 - SMBv3 RCE

718 2020-10-01
jamf/CVE-2020-0796-RCE-POC

CVE-2020-0796 Remote Code Execution POC

572 2020-06-09
Barriuso/SMBGhost_AutomateExploitation

SMBGhost (CVE-2020-0796) Automate Exploitation and Detection

343 2022-03-30
eerykitty/CVE-2020-0796-PoC

PoC for triggering buffer overflow via CVE-2020-0796

333 2023-02-26
jamf/CVE-2020-0796-LPE-POC

CVE-2020-0796 Local Privilege Escalation POC

245 2020-04-02
Rvn0xsy/CVE_2020_0796_CNA

Cobalt Strike AggressorScripts CVE-2020-0796

75 2020-09-09
ioncodes/SMBGhost

Scanner for CVE-2020-0796 - A SMBv3.1.1 + SMB compression RCE

58 2020-03-13
k8gege/PyLadon

Ladon Scanner For Python, Large Network Penetration Scanner & Cobalt Strike, vulnerability / exploit / detection / MS17010/SmbGhost/CVE-2020-0796/CVE-

51 2020-12-08
jamf/SMBGhost-SMBleed-scanner

SMBGhost (CVE-2020-0796) and SMBleed (CVE-2020-1206) Scanner

44 2020-07-06
eastmountyxz/CVE-2020-0796-SMB

该资源为CVE-2020-0796漏洞复现,包括Python版本和C++版本。主要是集合了github大神们的资源,希望您喜欢~

33 2020-08-28
T13nn3s/CVE-2020-0796

Powershell SMBv3 Compression checker

28 2023-04-01
maxpl0it/Unauthenticated-CVE-2020-0796-PoC

An unauthenticated PoC for CVE-2020-0796

22 2020-03-15
Almorabea/SMBGhost-LPE-Metasploit-Module

This is an implementation of the CVE-2020-0796 aka SMBGhost vulnerability, compatible with the Metasploit Framework

20 2020-06-19
0x25bit/CVE-2020-0796-PoC

Weaponized PoC for SMBv3 TCP codec/compression vulnerability

19 2020-04-01
gabimarti/SMBScanner

Multithread SMB scanner to check CVE-2020-0796 for SMB v3.11

19 2020-08-20
ButrintKomoni/cve-2020-0796

Identifying and Mitigating the CVE-2020–0796 flaw in the fly

17 2020-03-12
f1tz/CVE-2020-0796-LPE-EXP

Windows SMBv3 LPE exploit 已编译版

17 2020-03-31
GuoKerS/aioScan_CVE-2020-0796

基于asyncio(协程)的CVE-2020-0796 速度还是十分可观的,方便运维师傅们对内网做下快速检测。

15 2020-03-18
joaozietolie/CVE-2020-0796-Checker

Script that checks if the system is vulnerable to CVE-2020-0796 (SMB v3.1.1)

14 2020-03-11
dickens88/cve-2020-0796-scanner

This project is used for scanning cve-2020-0796 SMB vulnerability

14 2020-03-12
w1ld3r/SMBGhost_Scanner

Advanced scanner for CVE-2020-0796 - SMBv3 RCE

14 2023-05-22
thelostworldFree/CVE-2020-0796

PoC RCE Reverse Shell for CVE-2020-0796 (SMBGhost)

11 2020-06-05
technion/DisableSMBCompression

CVE-2020-0796 Flaw Mitigation - Active Directory Administrative Templates

9 2020-03-11
9 2020-03-15
0xeb-bp/cve-2020-0796

CVE-2020-0796 (SMBGhost) LPE

7 2020-04-08
dungnm24/CVE-2020-0796

WindowsProtocolTestSuites is to trigger BSoD, and full exploit poc.

6 2023-05-29
vysecurity/CVE-2020-0796

CVE-2020-0796 - Working PoC - 20200313

5 2020-03-13
orangmuda/CVE-2020-0796

Remote Code Execution POC for CVE-2020-0796

5 2021-11-01
wneessen/SMBCompScan

Scanner script to identify hosts vulnerable to CVE-2020-0796

4 2020-03-12
tango-j/CVE-2020-0796

Coronablue exploit

4 2020-03-31
sujitawake/smbghost

CVE-2020-0796_CoronaBlue_SMBGhost

3 2020-03-19
exp-sky/CVE-2020-0796

SMBv3 Ghost (CVE-2020-0796) Vulnerability

3 2020-06-09
laolisafe/CVE-2020-0796

SMBv3 RCE vulnerability in SMBv3

2 2020-03-13
TinToSer/CVE-2020-0796-LPE

SMBGHOST local privilege escalation

2 2020-03-31
2 2020-09-28
DannyRavi/nmap-scripts

nmap scripts for vuln cve-2020-0796 & cve-2019-7238 & cve2019-11580 & cve2017-6327

2 2025-04-20
Jagadeesh7532/-CVE-2020-0796-SMBGhost-Windows-10-SMBv3-Remote-Code-Execution-Vulnerability

CVE-2020-0796 (SMBGhost) is a critical RCE vulnerability in Windows 10 SMBv3 protocol. It allows attackers to execute code remotely via crafted SMB pa

2 2025-09-21
awareseven/eternalghosttest

This repository contains a test case for CVE-2020-0796

1 2022-08-30
Dhoomralochana/Scanners-for-CVE-2020-0796-Testing

Scanners List - Microsoft Windows SMBv3 Remote Code Execution Vulnerability (CVE-2020-0796)

1 2020-03-12
netscylla/SMBGhost

SMBGhost (CVE-2020-0796) threaded scanner

1 2020-03-12
BinaryShadow94/SMBv3.1.1-scan---CVE-2020-0796

Little scanner to know if a machine is runnig SMBv3 (possible vulnerability CVE-2020-0796)

1 2020-03-13
ran-sama/CVE-2020-0796

Lightweight PoC and Scanner for CVE-2020-0796 without authentication.

1 2026-01-10
julixsalas/CVE-2020-0796

Scanner for CVE-2020-0796

1 2022-01-28
cory-zajicek/CVE-2020-0796-DoS

DoS PoC for CVE-2020-0796 (SMBGhost)

1 2020-03-24
1 2020-04-03
F6JO/CVE-2020-0796-Batch-scanning

批量扫描CVE-2020-0796

1 2021-10-28
arzuozkan/CVE-2020-0796

CVE-2020-0796 explanation and researching vulnerability for term porject CENG325

1 2022-06-07
1 2022-11-10
OldDream666/cve-2020-0796

cve-2020-0796利用工具集

1 2023-06-04
AdamSonov/smbGhostCVE-2020-0796

This script will help you to scan for smbGhost vulnerability(CVE-2020-0796)

1 2024-03-04
xax007/CVE-2020-0796-Scanner

CVE-2020-0796 SMBv3.1.1 Compression Capability Vulnerability Scanner

0 2020-03-12
UraSecTeam/smbee

Check system is vulnerable CVE-2020-0796 (SMB v3)

0 2020-03-12
Almorabea/SMBGhost-WorkaroundApplier

This script will apply the workaround for the vulnerability CVE-2020-0796 for the SMBv3 unauthenticated RCE

0 2020-03-13
wsfengfan/CVE-2020-0796

CVE-2020-0796 Python POC buffer overflow

0 2020-03-14
intelliroot-tech/cve-2020-0796-Scanner

This tool helps scan large subnets for cve-2020-0796 vulnerable systems

0 2020-04-14
bacth0san96/SMBGhostScanner

SMBGhost CVE-2020-0796

0 2021-04-20
0 2020-06-02
0 2020-11-11
1060275195/SMBGhost

批量测试CVE-2020-0796 - SMBv3 RCE

0 2020-06-03
0 2020-11-06
vsai94/ECE9069_SMBGhost_Exploit_CVE-2020-0796-

Description of Exploit SMBGhost CVE-2020-0796

0 2022-03-28
TweatherQ/CVE-2020-0796

CVE-2020-0796-利用工具

0 2022-12-15
krizzz07/CVE-2020-0796

windows 10 SMB vulnerability

0 2023-01-29
z3ena/Exploiting-and-Mitigating-CVE-2020-0796-SMBGhost-and-Print-Spooler-Vulnerabilities

This repository contains detailed documentation and code related to the exploitation, detection, and mitigation of two significant vulnerabilities: CV

0 2024-08-12
Justjeff211/conti-ransomware-writeup

Conducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows

0 2026-03-27
88 repos — triés par ⭐ Rechercher sur GitHub ↗

Signal Intelligence

Confidence
92%
EPSS 94.42%
CVSS v3.1 10
Mentions 7
Last Seen Mar 16, 2020

CNA Information

CNA Assigner
microsoft

Analyst Note

CVE-2020-0796 is the critical SMBv3 RCE vulnerability (WinRAT/CVE-2020-0796) publicly exploited in the wild in March 2020 before patches were widely available. CERT-EU advisory confirms active exploitation. Microsoft released emergency patches on March 12, 2020, the same day the vulnerability became public knowledge, indicating zero-day exploitation preceded patch availability.

Threat Actors 8

Cobalt
apt_group Financial crime 🇷🇺 RU
Harvester
apt_group Information theft and espionage Unknown
Ice Fog
apt_group Information theft and espionage 🇨🇳 CN
Earth Lamia
apt_group Information theft and espionage 🇨🇳 CN
Dalbit
apt_group Information theft and espionage 🇨🇳 CN
PhantomCore
apt_group 🇷🇺 RU
TA410
apt_group Information theft and espionage 🇨🇳 CN
Witchetty
apt_group 🇨🇳 CN

Triage Info

Decided atMar 05, 2026
Published DateMar 12, 2020