IRONSMITHINTEL
CRITICALCVSS10.0
|
Actively Exploited
|CISA KEV|CVE-2020-0796|Auth: none — unauthenticated|Reboot: required|Manual only

KB4551762: Windows Server Security Update (March 2020)

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.

Published Mar 12, 2020 · Updated May 16, 2026
Why patchRisk explained in plain English
Worst-case scenarioIf unpatched

A remote attacker, without authentication, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. CISA has confirmed use of this vulnerability in known ransomware campaigns — treat as high priority for remediation. Federal agencies are required to remediate by 2022-08-10 under CISA BOD 22-01.

How the attack worksNo clicks needed

This is a Buffer Overflow (CWE-119) vulnerability in Microsoft SMBv3. A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'. Exploitation requires remote network access, low attack complexity, no authentication required, and no user interaction required.

📧

Phishing link

→

🖼

Malicious file

🔓

Server compromised

Am I affected?Quick check

Probably yes if any of these apply:

●IT Security
●Running windows 10 1903: -; windows 10 1909: -; windows server 1903: -; windows server 1909: -
Fixed inKB4551762 (applies to 8 product versions)
Real-world incidentsWhat we've seen

Used in known ransomware campaigns. Threat-research write-up: http://packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.html

How to patch

Manual download

For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.

↗ Microsoft Update CatalogKB4551762

Manual remediation steps

Apply the Microsoft Security Update

Microsoft has released an official security update that fixes this vulnerability.

Required KB Update

    1
    KB4551762 — https://support.microsoft.com/help/4551762

Supersedes: KB4540673

Affected Products

    1
    Windows 10 Version 1903 for 32-bit Systems
    1
    Windows 10 Version 1903 for ARM64-based Systems
    1
    Windows 10 Version 1903 for x64-based Systems
    1
    Windows 10 Version 1909 for 32-bit Systems
    1
    Windows 10 Version 1909 for ARM64-based Systems
    1
    Windows 10 Version 1909 for x64-based Systems
    1
    Windows Server, version 1903 (Server Core installation)
    1
    Windows Server, version 1909 (Server Core installation)

Installation Methods

Windows Update (recommended)

1
Settings → Windows Update → Check for updates
2
The security update is offered if your system is in scope
3
Restart when prompted — a reboot IS required to complete the install

Microsoft Update Catalog (manual download)

1
Open https://catalog.update.microsoft.com
2
Search for KB4551762
3
Download the package matching your OS architecture and Windows build
4
Run the .msu installer with administrator privileges
5
Restart when prompted

WSUS / SCCM / Intune

Approve KB4551762 for the affected products in your update management console.

Microsoft Download Center Links

    1
    https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4551762

Verification

Confirm the update is installed:

Get-HotFix | Where-Object { $_.HotFixID -in @('KB4551762') }

References

    1
    Microsoft Security Response Center: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796
    1
    KB article: https://support.microsoft.com/help/4551762
    1
    NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2020-0796
    1
    CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0796

Discovery Credit

Microsoft Platform Security Assurance & Vulnerability Research

PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

References

↗ CVE-2020-0796↗ MSRC Advisory↗ NVD↗ KBKB4551762