Microsoft .NET Framework & SharePoint XOML Injection Remote Code Execution Vulnerability Advisory (CVE-2020-0646)
Executive & SecOps Summary
SECOPS ASSESSMENTSystems running Microsoft .NET Framework versions 2.0, 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and Microsoft SharePoint Server.
An unauthenticated remote attacker can execute arbitrary code with system privileges by sending a specially crafted XOML (XML Process Markup Language) file to the target server.
Immediately apply the official Microsoft security patches and restrict untrusted XOML workflow compilation within your SharePoint environment.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to apply the official Microsoft security updates. Use the following PowerShell commands to identify and install the required .NET Framework security patches on Windows Server.
# Install Windows Update module and search for the specific security patches
Install-Module PSWindowsUpdate -Force -Verbose
Get-WindowsUpdate -KBArticleID KB4535102, KB4535103, KB4535104, KB4535106
# Force install the required .NET Framework security update
Install-WindowsUpdate -KBArticleID KB4535102 -AcceptAll -AutoReboot2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict unauthorized workflow compilation by hardening the web.config file of your SharePoint web applications to limit the execution of untrusted XOML files.
<!-- Restrict unauthorized workflow types in web.config -->
<configuration>
<System.Workflow.ComponentModel.WorkflowCompiler>
<authorizedTypes>
<!-- Strictly limit the allowlist to prevent untrusted XOML compilation -->
<authorizedType Assembly='System.Workflow.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' Namespace='System.Workflow.Activities' TypeName='*' Authorized='True' />
</authorizedTypes>
</System.Workflow.ComponentModel.WorkflowCompiler>
</configuration>3. Log Audit & IoC Verification Commands
Run the following PowerShell script to inspect IIS access logs and Windows Event Logs for potential indicators of compromise (IoCs) related to XOML injection attempts.
# Search IIS logs for suspicious requests targeting .xoml files
$LogPath = 'C:\inetpub\logs\LogFiles\W3SVC1\*'
Select-String -Path $LogPath -Pattern '.xoml' | Select-Object -First 50
# Query Application Event Logs for .NET Runtime errors related to WorkflowCompiler
Get-WinEvent -LogName Application | Where-Object { $_.ProviderName -eq '.NET Runtime' -and $_.Message -like '*WorkflowCompiler*' } | Format-Table TimeCreated, Id, Message -AutoSizeBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability is a critical remote code execution (RCE) flaw that occurs when the Microsoft .NET Framework fails to properly validate input data. Specifically, the root cause lies within the deserialization and compilation process of XOML (XML Process Markup Language) files used by the Windows Workflow Foundation (WF). Due to insufficient input validation, an attacker can inject malicious code blocks into a XOML file, which the .NET Framework's workflow compiler then processes and executes on the server.
2. Exploitation Mechanics & Attack Scenario
Attackers target vulnerable endpoints in SharePoint that process user-defined workflows. The XOML file defines the structure of a workflow in XML format. When the .NET Framework's WorkflowCompiler class parses this file, it dynamically generates and compiles C# or VB.NET code in memory. By exploiting this behavior, an attacker can perform a 'XOML Injection' attack, embedding malicious compiler directives or code payloads. When the server attempts to load and compile the malicious workflow, the payload executes under the security context of the IIS worker process (w3wp.exe) or the SharePoint service account without requiring authentication.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an extreme risk to enterprise environments. Successful exploitation allows attackers to gain initial access, execute arbitrary commands, move laterally within the internal network, and potentially compromise sensitive databases or deploy ransomware across the infrastructure.
Official Vendor Advisories & References
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
Frequently Asked SecOps Questions (CVE-2020-0646)
FAQQ1. How critical is CVE-2020-0646 and is it actively exploited in the wild?
CVE-2020-0646 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-0646?
Primary impacted vendors include microsoft across .net framework, sharepoint. Scope summary: Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and Microsoft SharePoint Server 2010, 2013, 2016, 2019
Q3. What temporary mitigations or workarounds exist for CVE-2020-0646 before patching?
[Mitigation] Immediately apply the official Microsoft security patches and restrict untrusted XOML workflow compilation within your SharePoint environment. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-0646
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-58644, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft Office SharePoint Missing Authentication Privilege Escalation Vulnerability (CVE-2026-56164) Security Advisory
[Affected Scope] Microsoft Office SharePoint Server environments
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-50522, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft SharePoint Weak Authentication Bypass Vulnerability (CVE-2026-55040) Security Advisory
[Affected Scope] Microsoft SharePoint Server on-premises deployments
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.