CVE-2020-1147VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-1147: Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability

Affects Microsoft .NET Framework, SharePoint, Visual StudioSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 94.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-1147 (opens in a new tab)

Description

CVE-2020-1147 is a remote code execution vulnerability affecting Microsoft .NET Framework, SharePoint, and Visual Studio. The flaw arises from improper validation of the source markup in XML file input, allowing attackers to execute arbitrary code within the context of the deserialization process. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.

Summary

Microsoft .NET Framework, SharePoint, and Visual Studio contain a remote code execution vulnerability identified as CVE-2020-1147. The vulnerability occurs because the software does not properly validate the source markup of XML file input during deserialization. Successful exploitation permits an attacker to execute code with the privileges of the process handling the XML deserialization. This vulnerability has been observed in active exploitation scenarios.

Impact

Exploitation of this vulnerability allows remote attackers to execute arbitrary code on affected systems, potentially leading to full system compromise under the privileges of the vulnerable process. This can result in unauthorized control over the affected environment.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor Microsoft advisories closely and apply updates as soon as they become available.

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:10:36 UTC

References

Related threats