Microsoft .NET Framework, SharePoint, and Visual Studio XML Deserialization Remote Code Execution Vulnerability (CVE-2020-1147)
Executive & SecOps Summary
SECOPS ASSESSMENTUnpatched installations of .NET Framework, Microsoft SharePoint Server, and Visual Studio
Remote attackers can execute arbitrary code (RCE) with high privileges by sending a specially crafted XML payload to vulnerable endpoints
Apply the official Microsoft security updates immediately and restrict untrusted XML deserialization using DataSet/DataTable
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to apply the official Microsoft security updates. Use the following PowerShell commands to force Windows Update to retrieve and install the latest cumulative updates for .NET Framework and SharePoint.
# Install Windows Update module and apply all pending security patches
Install-Module PSWindowsUpdate -Force -Verbose
Get-WindowsUpdate -Category 'Security Updates' -AcceptAll -Install -AutoReboot2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, deploy Web Application Firewall (WAF) rules to block incoming XML payloads containing serialized DataSet or DataTable structures. Below is an Nginx configuration snippet to block suspicious XML payloads.
# Block malicious XML deserialization payloads at the reverse proxy level
server {
listen 443 ssl;
server_name sharepoint.company.com;
location / {
# Block requests containing common .NET deserialization gadget indicators
if ($request_body ~* '(System.Data.DataSet|System.Data.DataTable|TypeSerializer)') {
return 403 'Access Denied: Malicious XML Payload Detected';
}
proxy_pass http://sharepoint_backend;
}
}3. Log Audit & IoC Verification Commands
Run the following PowerShell script to verify the installed .NET Framework version and inspect IIS logs for potential exploitation attempts.
# Check the installed .NET Framework release version
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full' | Select-Object Release, Version
# Search IIS log files for suspicious DataSet/DataTable references in requests
Select-String -Path 'C:\inetpub\logs\LogFiles\W3SVC1\*.log' -Pattern 'DataSet' -Context 0, 2Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio due to a failure to properly validate the source markup of XML file inputs. Specifically, the System.Data.DataSet and System.Data.DataTable classes in .NET utilize internal XML parsing mechanisms (such as ReadXml) that are susceptible to insecure deserialization. When processing untrusted XML schemas, the application can be coerced into instantiating arbitrary object types, leading to unexpected code execution in the context of the running process.
2. Exploitation Mechanics & Attack Scenario
An attacker exploits this vulnerability by submitting a crafted XML payload containing serialized objects designed to trigger a specific gadget chain during deserialization. When the target application parses this XML via vulnerable .NET APIs, the deserializer instantiates the malicious payload, executing arbitrary system commands or loading unauthorized DLLs. Public exploits demonstrate that this can be achieved remotely against SharePoint web parts or custom .NET web applications without requiring high-level administrative privileges.
3. Infrastructure & Business Impact
This vulnerability is highly critical, as evidenced by its inclusion in the CISA KEV catalog and an EPSS score of 0.958 (95.8%). Successful exploitation grants the attacker full control over the affected SharePoint or web application server. This can lead to lateral movement within the corporate network, sensitive data exfiltration, ransomware deployment, and severe operational disruption.
Official Vendor Advisories & References
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
Frequently Asked SecOps Questions (CVE-2020-1147)
FAQQ1. How critical is CVE-2020-1147 and is it actively exploited in the wild?
CVE-2020-1147 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 95.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-1147?
Primary impacted vendors include microsoft across .net framework, sharepoint server, visual studio. Scope summary: .NET Framework 2.0 SP2 through 4.8, Microsoft SharePoint Server 2013/2016/2019, and Visual Studio 2012 through 2019 without the July 2020 security updates
Q3. What temporary mitigations or workarounds exist for CVE-2020-1147 before patching?
[Mitigation] Apply the official Microsoft security updates immediately and restrict untrusted XML deserialization using DataSet/DataTable Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-1147
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-58644, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-50522, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft SharePoint Weak Authentication Bypass Vulnerability (CVE-2026-55040) Security Advisory
[Affected Scope] Microsoft SharePoint Server on-premises deployments
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-65660)
[Affected Scope] Microsoft SharePoint Server 2016, 2019, and Subscription Edition.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.