A remote code execution vulnerability exists when the Microsoft

CVE-2020-0646 is an input-validation flaw in the Microsoft .NET Framework Workflow Compiler as invoked by SharePoint when processing XOML (Extensible Object Markup Language) workflow definitions. An authenticated SharePoint user with rights to create or edit a workflow can inject crafted XML that the server-side compiler treats as code, yielding RCE as the SharePoint application pool identity (typically the farm or web-app service account). Affected: .NET Framework 3.5 / 4.5.2 / 4.6 / 4.6.2 / 4.7 / 4.7.1 / 4.7.2 / 4.8 across Windows client and Server SKUs, and SharePoint Server 2010 SP2 / 2013 SP1 / 2016 / 2019 prior to the January 2020 cumulative update.

Vendor labels this 9.8 / Critical with PR:N, which is misleading: MSRC's own write-up and MDSec's PoC require an authenticated SharePoint principal that can submit a workflow. Reality is closer to AV:N / PR:L / UI:N / RCE — i.e., a high authenticated bug, not a drive-by. That said, EPSS 0.992, KEV listing, public Metasploit module, and the canonical SharePoint role (identity-adjacent, frequently service-account-rich) keep this firmly in HIGH territory.

Why this verdict

• Authentication required, not PR:N: MDSec's PoC and the Metasploit module both need a workflow-author principal. The CVSS PR:N claim does not survive contact with the source research — this is the single biggest reason for the downgrade from 9.8.
• KEV + EPSS 0.992: active, repeatable exploitation in the wild; ignoring this entirely is not defensible even with the auth prerequisite.
• Role multiplier — SharePoint as identity-adjacent tier: SharePoint farm accounts are domain users, often with read access to AD attributes, mailbox enumeration via Graph, and SPNs that invite Kerberoasting. RCE in w3wp.exe is a credible launchpad to domain compromise, which floors this at HIGH.
• Compensating friction: most modern farms front SharePoint with Entra SSO + MFA + Conditional Access; the attacker must first land a valid corporate identity, which is non-trivial but not rare.
• Patch is six years old: any unpatched farm is by definition outside normal lifecycle and likely has additional 2019-era SharePoint bugs (CVE-2019-0604) co-resident.

Why not higher?

CRITICAL would require unauthenticated reachable RCE on a widely-exposed component. The auth requirement collapses the candidate population to existing employees / contractors / partners with workflow rights, and most SharePoint farms are not internet-facing in 2026.

Why not lower?

MEDIUM is wrong because KEV listing and EPSS 0.992 reflect ongoing real-world abuse, and the role multiplier (SharePoint farm service account → AD) means a successful chain is not contained to a single host.

1. Apply January 2020 (or later) SharePoint + .NET cumulative updates — This is the only durable fix. Under the noisgate remediation SLA for HIGH, complete farm-wide patching within 180 days; if any farm is internet-reachable, treat as KEV override and patch within hours.
2. Block declarative/sandboxed workflow creation for non-admin users — In Central Admin → Web Application General Settings, disable user-defined workflows on web apps that don't need them. Removes the primary attack surface even on unpatched farms. Deploy within 30 days per noisgate mitigation SLA for HIGH.
3. Put SharePoint behind Entra Application Proxy / ZTNA with MFA + device compliance — Eliminates anonymous internet exposure and raises the cost of acquiring the workflow-author foothold. Conditional-access policies should require compliant device for any non-read action.
4. Constrain SharePoint farm and app-pool service accounts — Convert to gMSA, strip local admin on non-WFE hosts, remove SPN-based unconstrained/constrained delegation, and add to Protected Users where compatible. Limits blast radius post-RCE.
5. Deploy WAF rules blocking <x:Code> / Code= in XOML POSTs — F5 ASM, Azure WAF, and Imperva all have rules for this CVE family — enable in blocking (not detect-only) mode.

Run on each SharePoint WFE / app server as a local admin (or via PSRemoting from an auditor workstation: Invoke-Command -ComputerName SP01 -ScriptBlock { ... }). Script inspects installed .NET Framework build and SharePoint CU level against the January 2020 fix baseline. Outputs VULNERABLE, PATCHED, or UNKNOWN.

#requires -RunAsAdministrator
# noisgate verification: CVE-2020-0646 (.NET Framework / SharePoint XOML RCE)
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'
$verdict = 'UNKNOWN'

try {
    # --- .NET Framework 4.x build check (fix shipped Jan 14 2020) ---
    $ndp = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full' -ErrorAction SilentlyContinue
    $release = $ndp.Release
    # Jan-2020 servicing baselines: 4.8=528372+, 4.7.2=461823+, 4.7.1=461320+, 4.6.2=394821+
    $netVulnerable = $false
    if ($release) {
        if     ($release -ge 528040 -and $release -lt 528372) { $netVulnerable = $true }
        elseif ($release -ge 461808 -and $release -lt 461823) { $netVulnerable = $true }
        elseif ($release -ge 461308 -and $release -lt 461320) { $netVulnerable = $true }
        elseif ($release -ge 394802 -and $release -lt 394821) { $netVulnerable = $true }
    }

    # --- SharePoint version check (if installed) ---
    $spVulnerable = $false
    $spReg = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\*\WSS' -ErrorAction SilentlyContinue
    foreach ($sp in $spReg) {
        $v = [version]$sp.Version
        # SP2019 fix: 16.0.10362.20001 | SP2016: 16.0.4915.1000 | SP2013: 15.0.5197.1000
        if ($v.Major -eq 16 -and $v.Minor -eq 0 -and $v.Build -lt 4915) { $spVulnerable = $true }
        if ($v.Major -eq 15 -and $v.Minor -eq 0 -and $v.Build -lt 5197) { $spVulnerable = $true }
    }

    if ($netVulnerable -or $spVulnerable) { $verdict = 'VULNERABLE' }
    elseif ($release) { $verdict = 'PATCHED' }
}
catch {
    $verdict = 'UNKNOWN'
}

Write-Output $verdict
switch ($verdict) {
    'PATCHED'    { exit 0 }
    'VULNERABLE' { exit 1 }
    default      { exit 2 }
}

Sources

1. NVD — CVE-2020-0646
2. MDSec — Code injection in Workflows leading to SharePoint RCE
3. Metasploit PR #13122 — SharePoint Workflows XOML RCE
4. AttackerKB — CVE-2020-0646
5. CISA KEV Catalog
6. GHSA-4w3v-83v8-mg94
7. Tenable — CVE-2020-0646
8. MSRC advisory