Remote Code Execution in Microsoft SQL Server Reporting Services (CVE‑2020‑0618) Enables Authenticated Attackers to Run Code as Service Account
What It Is – Microsoft SQL Server Reporting Services (SSRS) contains a deserialization flaw that mishandles page requests. An attacker who can authenticate to the server can exploit the bug to execute arbitrary code in the context of the Report Server service account.
Exploitability – The vulnerability is publicly disclosed with a CVSS v3.1 base score of 8.8 (High). No public exploit code is known, but the attack requires only valid credentials and can be carried out remotely.
Affected Products – Microsoft SQL Server Reporting Services (all supported versions prior to the security update released March 2020).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous control mapping: organizations must align patch‑management controls with their chosen frameworks and retain evidence of remediation.
- Highlights the importance of defensible audit trails: logging of SSRS service activity and remediation steps provides proof of due diligence during audits.
- Reinforces risk‑based due diligence: vendors and customers alike expect documented evidence that known software flaws are promptly addressed.
Recommended Actions
- Apply Microsoft’s security update for CVE‑2020‑0618 immediately.
- Verify SSRS version and patch level across all environments using an automated inventory tool.
- Enable detailed logging for the Report Server service and monitor for anomalous execution patterns.
- Document the remediation process and map the patch‑management activity to the relevant control objective in your framework of record.
Source: CISA KEV – CVE‑2020‑0618