Is CVE-2020-12736 actively exploited?

No active exploitation of CVE-2020-12736 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-12736 be exploited remotely?

Yes. CVE-2020-12736 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2020-12736?

CVE-2020-12736 has a CVSS score of 7.2 (HIGH).

HOME VULNERABILITIESCVE-2020-12736

HIGH

CVE-2020-12736

CWE-74Published: July 7, 2020· Updated: Jun 17, 2026

7.2

CVSS v3.1

Official Description

Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution. When an administrator creates a local (non-SSO) user via a Code42-generated email, the administrator has the option to modify content for the email invitation. If the administrator entered template language code in the subject line, that code could be interpreted by the email generation services, potentially resulting in server-side code injection.

NVD Source

Technical Analysis

CVE-2020-12736 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.2.