CVE-2020-16898
<p>A remote code execution vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attacker who successfully exploited this vulnerability could gain the ability to execute code on the target server or client.</p> <p>To exploit this vulnerability, an attacker would have to send specially crafted ICMPv6 Router Advertisement packets to a remote Windows computer.</p> <p>The update addresses the vulnerability by correcting how the Windows TCP/IP stack handles ICMPv6 Router Advertisement packets.</p>
- CVSS
- 8.8Highscored by the publisher (CNA)
- Exploited in the wild
- Not knownUnvetted proof-of-concept code on GitHub; not in CISA KEV
- EPSS
- 10.9%chance of exploitation in the next 30 daystop 5% of scored CVEsFIRST score of 11 Nov 2026
- Fix
- Patch availablesee the advisories in the references
- Published
- 16 Oct 2020analysed here 12 Nov 2026
Summary
Triage
- Exploitable
- At runtime
- Attack vector
- adjacent network
- Can a WAF block it?
- No. See why
The summary, impact and action text on this page are written by our AI analysis pipeline, or taken from the NVD description when a CVE was imported from NVD. They are not the vendor's wording: check them against the sources. A longer AI executive summary and technical analysis are generated for signed-in accounts on the Max plan.
Affected products
| Product | Affected versions | Vendor says fixed in |
|---|---|---|
| Microsoft Windows 10 Version 1709 | >= 10.0.0 and < publicationVendor says fixed in: not stated | |
| Microsoft Windows 10 Version 1709 for 32-bit Systems | >= 10.0.0 and < publicationVendor says fixed in: not stated | |
| Microsoft Windows 10 Version 1803 | >= 10.0.0 and < publicationVendor says fixed in: not stated | |
| Microsoft Windows 10 Version 1809 | >= 10.0.0 and < publicationVendor says fixed in: not stated | |
| Microsoft Windows 10 Version 1903 for 32-bit Systems | >= 10.0.0 and < publicationVendor says fixed in: not stated | |
| Microsoft Windows 10 Version 1903 for ARM64-based Systems | >= 10.0.0 and < publicationVendor says fixed in: not stated | |
| Microsoft Windows 10 Version 1903 for x64-based Systems | >= 10.0.0 and < publicationVendor says fixed in: not stated | |
| Microsoft Windows 10 Version 1909 | >= 10.0.0 and < publicationVendor says fixed in: not stated | |
| Microsoft Windows 10 Version 2004 | >= 10.0.0 and < publicationVendor says fixed in: not stated | |
| Microsoft Windows Server 2019 | >= 10.0.0 and < publicationVendor says fixed in: not stated | |
| Microsoft Windows Server 2019 (Server Core installation) | >= 10.0.0 and < publicationVendor says fixed in: not stated | |
| Microsoft Windows Server, version 1903 (Server Core installation) | >= 10.0.0 and < publicationVendor says fixed in: not stated | |
| Microsoft Windows Server, version 1909 (Server Core installation) | >= 10.0.0 and < publicationVendor says fixed in: not stated | |
| Microsoft Windows Server version 2004 | >= 10.0.0 and < publicationVendor says fixed in: not stated |
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.
Products named in our analysis
- microsoft:windows_10
- microsoft:windows_server_2016
- microsoft:windows_server_2019
Fix and mitigation
WAF and other mitigations
Can a WAF block it? No. The attack does not come over the network, so a WAF is not on its path. Patching is the reliable fix.
Also consider: patch
Based on the weakness type only; no CVE-specific evidence yet. We check Cloudflare, AWS, Google Cloud Armor and Azure; for Akamai, Imperva, Fastly, F5, ask your vendor.
Remediation steps (AI-written)
Step-by-step remediation is generated for accounts on the Max plan, for CVEs that match a technology in their stack. Add this technology to your stack to see the fix checklist.
Exploitation evidence
- CISA KEV catalog
- Not listed as of our last sync.
- Public exploit code
- Unvetted proof-of-concept code on GitHub: 15 GitHub proofs of concept
GitHub proofs of concept
- advanced-threat-research/CVE-2020-16898209 stars
- ZephrFish/CVE-2020-1689822 stars
- 0xeb-bp/cve-2020-1689822 stars
- momika233/CVE-2020-16898-exp17 stars
and 11 more repositories
Listed so you can judge urgency, not as a recommendation to run anything. GitHub “proofs of concept” are unvetted: some are fake or carry malware. Exploit-DB marks the entries its staff verified.
Timeline
- 7 Oct 2020First proof-of-concept repository on GitHub (unvetted)
- 16 Oct 2020Published10 days later
- 4 Aug 2024CVE record last updated1,388 days (about 4 years) later
- 12 Nov 2026Analysed by vulneraibility.com830 days (about 2 years) later
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Metric | Value | What it means |
|---|---|---|
| Attack vector | AdjacentSame subnet or link layer. | Same subnet or link layer. |
| Attack complexity | LowRepeatable attack, no special conditions. | Repeatable attack, no special conditions. |
| Privileges required | NoneThe attacker needs no prior access. | The attacker needs no prior access. |
| User interaction | NoneNo victim action needed. | No victim action needed. |
| Scope | UnchangedImpact stays within the vulnerable component. | Impact stays within the vulnerable component. |
| Confidentiality | HighTotal data disclosure possible. | Total data disclosure possible. |
| Integrity | HighComplete modification possible. | Complete modification possible. |
| Availability | HighFull outage possible. | Full outage possible. |
Common questions
Is CVE-2020-16898 being exploited?
Not confirmed. CVE-2020-16898 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 11% probability of exploitation in the next 30 days.
How severe is CVE-2020-16898?
CVE-2020-16898 is rated High with a CVSS score of 8.8. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2020-16898?
Yes. A fix has been recorded for CVE-2020-16898. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2020-16898 affect?
CVE-2020-16898 affects microsoft:windows_10, microsoft:windows_server_2016, microsoft:windows_server_2019. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
References
1 reference in the CVE record, grouped by the tags the record gives them.
Other links (1)
- portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2020-16898
Where the data on this page comes from
- CVE List (CVE.org): description, affected versions, references; CVE Terms of Use
- NVD: CVSS and CPE data
- FIRST EPSS: exploit probability and percentile
- PoC-in-GitHub: GitHub repositories that claim a proof of concept
Summary, impact and triage tags: written by our AI analysis pipeline from the sources above. Check them against the sources.
Similar CVEs
Get CVEs like this by email. Join the free digest: the CVEs we flag as major, all CVSS 8.0 or higher, in up to three emails a day (sent at 05:00, 11:00 and 15:00 UTC). Matching alerts to the products you run needs an account, and accounts are invite-only during the beta.