CVE-2020-10713: A flaw was found in grub2, prior to version 2.06.

Is it exploited?

Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of 29 Oct 2026.

VulnCheck KEV lists it since 1 Oct 2020. It cites 3 public reports, the first from 1 Oct 2020.

• know.netenrich.com
• cybersecurityworks.com
• ivanti.com

How likely is exploitation in the next 30 days?

1.7%

EPSS score, percentile 77.3 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?

Not scored

The CVE record carries no CVSS score.

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (6)

Which versions are affected?

Affected

• All grub2 versions before 2.06

Versions by product

Source: CISA KEV 2026.10.29, as of 29 Oct 2026; VulnCheck KEV, as of 30 Oct 2026; FIRST EPSS, as of 29 Oct 2026; CVE List, as of 30 Oct 2026. About the data.

Description

A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Source: CVE List, as of 30 Oct 2026. About the data.

What to do

Advisories and patches

• DSA-4735 (Vendor advisory)
• USN-4432-1 (Vendor advisory)
• 20200804 GRUB2 Arbitrary Code Execution Vulnerability (Vendor advisory)
• openSUSE-SU-2020:1169 (Vendor advisory)
• openSUSE-SU-2020:1168 (Vendor advisory)
• GLSA-202104-05 (Vendor advisory)

This summary is based on the CVE record as of 30 Oct 2026. Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

Source: CVE List, as of 30 Oct 2026. About the data.

Timeline