Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
What to do
Required action, set by CISA
Apply updates per vendor instructions.
CISA due date for this action: .
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Microsoft Microsoft Visual Studio 2019 version 16.6 (includes 16.0 - 16.5)
Status
Versions
Affected
unspecified
Microsoft Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
Status
Versions
Affected
unspecified
Microsoft Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
Status
Versions
Affected
unspecified
Microsoft .NET Core
Status
Versions
Affected
2.1
Affected
3.1
Microsoft Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2
Status
Versions
Affected
Windows 7 for 32-bit Systems Service Pack 1
Affected
Windows 7 for x64-based Systems Service Pack 1
Affected
Windows 8.1 for 32-bit systems
Affected
Windows 8.1 for x64-based systems
Affected
Windows RT 8.1
Affected
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Affected
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core instal…
Affected
Windows Server 2012
Affected
Windows Server 2012 (Server Core installation)
Affected
Windows Server 2012 R2
Affected
Windows Server 2012 R2 (Server Core installation)
Microsoft Microsoft .NET Framework 4.8 on Windows 10 Version 1803 for 32-bit Systems
Status
Versions
Affected
unspecified
Microsoft Microsoft .NET Framework 4.8 on Windows 10 Version 1803 for x64-based Systems
Status
Versions
Affected
unspecified
Microsoft Microsoft .NET Framework 4.8 on Windows Server, version 1803 (Server Core Installation)
Status
Versions
Affected
unspecified
Microsoft Microsoft .NET Framework 4.8 on Windows 10 Version 1709 for 32-bit Systems
Status
Versions
Affected
unspecified
Microsoft Microsoft .NET Framework 4.8 on Windows 10 Version 1709 for x64-based Systems
Status
Versions
Affected
unspecified
Microsoft Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for 32-bit Systems
Status
Versions
Affected
unspecified
Microsoft Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for x64-based Systems
Status
Versions
Affected
unspecified
Microsoft Microsoft .NET Framework 4.8 on Windows Server 2016
Status
Versions
Affected
unspecified
Microsoft Microsoft .NET Framework 4.8 on Windows Server 2016 (Server Core installation)
Status
Versions
Affected
unspecified
Microsoft Microsoft .NET Framework 4.8 on Windows 7 for 32-bit Systems Service Pack 1
Status
Versions
Affected
unspecified
Microsoft Microsoft .NET Framework 4.8 on Windows 7 for x64-based Systems Service Pack 1
Status
Versions
Affected
unspecified
Microsoft Microsoft .NET Framework 4.8 on Windows 8.1 for 32-bit systems
Status
Versions
Affected
unspecified
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
About this vulnerability
Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content.
Summary: CISA's KEV catalog, as of .
CISA added CVE-2020-1147 to its Known Exploited Vulnerabilities (KEV) catalog on 3 Nov 2021.
CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
The due date CISA sets for the required action is 3 May 2022.
The CVE record was published on 14 Jul 2020, 477 days before it was added to KEV.
The CVE record carries a CVSS v3.1 base score of 7.8 (High), taken from CISA's enrichment of the record.
FIRST's EPSS model puts the probability of exploitation in the next 30 days at 94% (percentile 99.8), as of 28 Oct 2026.
CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.
Description
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.