Critical Remote Code Execution in Microsoft .NET Framework, SharePoint, and Visual Studio (CVE‑2020‑1147)
What It Is – CVE‑2020‑1147 is a remote code execution flaw in Microsoft .NET Framework, SharePoint, and Visual Studio. The vulnerability stems from improper validation of XML markup during deserialization, allowing an attacker to run arbitrary code in the context of the vulnerable process.
Exploitability – The vulnerability is publicly known, has been weaponized in the wild, and carries a CVSS v3.1 base score of 9.8 (Critical). No authentication is required to exploit the flaw.
Affected Products – Microsoft .NET Framework (all supported versions), Microsoft SharePoint, and Microsoft Visual Studio.
Why It Matters for Trust & Control Assurance
- Patch Management Control – Demonstrates the need for a documented, continuously‑monitored patch‑management program that can provide auditable evidence of timely remediation.
- Secure Configuration Control – Highlights the importance of validating input handling and configuration baselines to prevent deserialization attacks.
- Defensible Audit Trail – Enterprises must retain proof that vulnerable components were identified, assessed, and patched before exploitation, satisfying multiple framework requirements (e.g., NIST CSF Identify‑Detect, ISO 27001 A.12.6).
Recommended Actions
- Apply Microsoft’s security update for CVE‑2020‑1147 immediately on all affected systems.
- Verify remediation by scanning for the patched version and confirming the absence of the vulnerable XML deserialization code path.
- Update your patch‑management policy to include automated detection of this class of deserialization flaws and retain evidence of patch deployment.
- Incorporate the vulnerability into your continuous control‑monitoring dashboard to demonstrate ongoing compliance.
Source: CISA KEV – CVE‑2020‑1147