CySec
en
  1. Home
  2. Blog
  3. Vulnerabilities & CVE

SMBGhost (CVE-2020-0796): a wormable flaw in SMBv3 compression

Three years after EternalBlue, a new SMB vulnerability with a maximum score affected Windows 10. Patch, and keep port 445 closed to the internet.

3 min read

Publicly disclosed: 10 March 2020

On 10 March 2020 Microsoft published an advisory about a vulnerability in how SMBv3.1.1 handled compressed messages; the update followed two days later. An unauthenticated attacker could run code on SMB servers and clients — and, like EternalBlue, the bug was wormable. It affected newer Windows 10 and Windows Server versions (1903 and 1909).

CVESeverityAffectedFixed in
CVE-2020-0796Critical, CVSS 10.0 (remote code execution)Windows 10 and Windows Server 1903, 1909KB4551762 (12 March 2020) and later updates

How to protect

  1. Install the update.
  2. Block port 445 at the internet edge — SMB should never be reachable from outside.
  3. If you cannot update a server immediately, Microsoft's workaround was to disable SMBv3 compression on the server (this does not protect SMB clients):
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force

Good Windows patching habits

  • Install Patch Tuesday updates (second Tuesday of every month) within days for internet-facing systems and within two weeks for the rest.
  • Watch for out-of-band updates — Microsoft releases them only for serious issues.
  • Replace Windows versions that no longer receive security updates.

Sources: Microsoft CVE-2020-0796, NVD CVE-2020-0796.

Need help with this? Contact CySec for a free consultation.

Tags:#Windows

All articles

More on this topic

All articles in this topic
12 November 2026· 3 min read

N-able N-central “4EverAble2Shell” zero-day: when the remote management server is the target

A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.

Read article
10 November 2026· 4 min read

Outlook zero-day CVE-2026-124194 and November 2026 Patch Tuesday: what to update first

An exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.

Read article
9 November 2026· 3 min read

Chrome zero-day CVE-2026-125350: update the browser and restart it

Google fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.

Read article

Need help with this?

Our engineers can review your current setup and propose concrete improvements.

Request a quote
WhatsApp+374 33 870717 Emailinfo@cysec.am