CVE-2020-1350VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-1350: Microsoft Windows DNS Server Remote Code Execution Vulnerability

Affects Microsoft WindowsSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 96.7% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

Description

CVE-2020-1350, also known as SIGRed, is a critical remote code execution vulnerability in Microsoft Windows DNS Server. It allows an attacker to send specially crafted requests that the DNS server fails to handle properly, leading to code execution with Local System privileges. This vulnerability has been exploited in the wild and poses a high risk to affected systems.

Summary

Microsoft Windows DNS Servers improperly handle certain DNS requests, enabling remote attackers to execute arbitrary code in the context of the Local System Account. The vulnerability, tracked as CVE-2020-1350 and nicknamed SIGRed, has been observed in active exploitation campaigns. It affects Windows DNS Server implementations, allowing attackers to gain full control over vulnerable servers remotely.

Impact

Successful exploitation results in remote code execution with Local System privileges, which can lead to complete compromise of the affected Windows DNS Server. This can allow attackers to execute arbitrary code, install programs, view, change, or delete data, or create new accounts with full user rights.

Mitigation

A fix is available for this vulnerability. Administrators should apply the official Microsoft security updates addressing CVE-2020-1350 immediately to mitigate the risk. Until patched, limiting exposure of DNS servers to untrusted networks can reduce the attack surface.

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:12:05 UTC

References

Related threats