CVE-2020-16846 KEVPublic exploit Critical · 9.8 EPSS 99.6%

SaltStack Salt Shell Injection Vulnerability

Summary

A shell injection flaw exists in SaltStack Salt through version 3002, in its Salt API component when the SSH client is enabled. An unauthenticated remote attacker who can reach the API can send crafted web requests that inject operating system commands, with no user interaction required.

Official description · NVD

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

Breakdown

69.8 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationAI-written (claude-haiku-5-5)Medium confidence149 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterAI-written (claude-haiku-5-5)Medium confidence95 general detection rules

First seen exploited 6 months after disclosure. Public exploit code (Metasploit) was available 3 days before disclosure.

Public exploit codeMetasploit3 Nov 20203 days before
Disclosed6 Nov 2020day 0
First seen exploitedVulnCheck KEV evidence24 Apr 2021+6 mo
Added to CISA KEVEU database agrees3 Nov 2021+12 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

7 fixes in salt over 14 months. The latest fix listed for salt is 3002.2.

Fixes in saltPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

2019.2.3CVE-2019-1736117 Jan 2020
3000.2CVE-2020-1165130 Apr 2020KEV
3000.2CVE-2020-1165230 Apr 2020KEV
3002.1CVE-2020-168466 Nov 2020KEV
3002.1CVE-2020-174906 Nov 2020
3002.1CVE-2020-255926 Nov 2020
3002.2CVE-2021-253153 Mar 2021Latest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

AI mapping from the description · how it is exploited

Unauthenticated crafted requests to public-facing API

Sending crafted web requests to the Salt API

From the official description (NVD) Original ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

AI mapping from the description · primary impact

Shell injection enables arbitrary command execution

can result in shell injection

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-16846 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: salt.

PyPIsaltGHSA-qr38-h96j-2j3w PYSEC-2020-104

Upgrade to 3002.5 or later

Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2020-25592, CVE-2021-25281, +2).

pippip install "salt>=3002.5"

First fixed in 3002.1 for CVE-2020-16846.

Affected versions, by release line

If you run	Upgrade to
3002 up to 3002.1	3002.5first fix for this CVE: 3002.1
3001 up to 3001.2	3001.5first fix for this CVE: 3001.2
3000.0 up to 3000.4	3000.7first fix for this CVE: 3000.4
3000 up to 3000.3 Still affected on this line by CVE-2020-25592 (fixed in 3000.5, a newer line); CVE-2021-25281 (fixed in 3000.6, a newer line); CVE-2021-25282 (fixed in 3000.6, a newer line); CVE-2021-3197 (fixed in 3000.6, a newer line).	3000.3
2019.2.0 up to 2019.2.6	2019.2.8first fix for this CVE: 2019.2.6
2019.2.0 up to 2019.2.5 Still affected on this line by CVE-2020-25592 (fixed in 2019.2.7, a newer line); CVE-2021-25281 (fixed in 2019.2.8, a newer line); CVE-2021-25282 (fixed in 2019.2.8, a newer line); CVE-2021-3197 (fixed in 2019.2.8, a newer line).	2019.2.5
2018.3.0rc1 up to 2018.3.5 Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).	2019.2.0rc1first fix for this CVE: 2018.3.5
2018.2.0 up to 2018.3.5 Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2021-25281 (fixed in 2019.2.0rc1, a newer line); CVE-2021-25282 (fixed in 2019.2.0rc1, a newer line); CVE-2021-3197 (fixed in 2019.2.0rc1, a newer line).	2018.3.5
2017.7.5 up to 2017.7.8 Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).	2017.7.8
2017.7.0 up to 2017.7.4 Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-25592 (fixed in 2017.7.8, a newer line); CVE-2021-25281 (fixed in 2017.7.8, a newer line); CVE-2021-25282 (fixed in 2017.7.8, a newer line); CVE-2021-3197 (fixed in 2017.7.8, a newer line).	2017.7.4
2017.5.0 up to 2017.7.8 Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).	2017.7.8
2016.11.7 up to 2016.11.10 Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).	2016.11.10
2016.11.4 up to 2016.11.6 Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-25592 (fixed in 2016.11.10, a newer line).	2016.11.6
2016.11.0 up to 2016.11.10 Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).	2016.11.10
2016.11.0 up to 2016.11.3 Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-25592 (fixed in 2016.11.10, a newer line); CVE-2021-25281 (fixed in 2016.11.5, a newer line); CVE-2021-25282 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).	2016.11.3
2016.3.7 up to 2016.3.8 Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2021-25281 (fixed in 2016.11.5, a newer line); CVE-2021-25282 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).	2016.3.8
2016.3.5 up to 2016.3.6 Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-25592 (fixed in 2016.3.8, a newer line); CVE-2021-25281 (fixed in 2016.11.5, a newer line); CVE-2021-25282 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).	2016.3.6
2016.3.0 up to 2016.3.8 Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2021-25281 (fixed in 2016.11.5, a newer line); CVE-2021-25282 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).	2016.3.8
2016.3.0 up to 2016.3.4 Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line); CVE-2020-25592 (fixed in 2016.3.8, a newer line); CVE-2021-25281 (fixed in 2016.11.5, a newer line); CVE-2021-25282 (fixed in 2016.11.5, a newer line); CVE-2021-3197 (fixed in 2016.11.5, a newer line).	2016.3.4
All versions before 2015.8.13 Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).	2015.8.13
All versions before 2015.8.10 Still affected on this line by CVE-2020-11651 (fixed in 2019.2.4, a newer line); CVE-2020-11652 (fixed in 2019.2.4, a newer line).	2015.8.13first fix for this CVE: 2015.8.10

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

15 links, grouped by NVD tag (14 duplicates merged)

Show 3 moreShow fewer

zerodayinitiative.com/advisories/ZDI-20-1381/zerodayinitiative.com/advisories/ZDI-20-1382/zerodayinitiative.com/advisories/ZDI-20-1383/

Release Notes 2

github.com/saltstack/salt/releases lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/

Exploitation evidence

Exploited in the wild

Listed since 3 Nov 2021. Federal due date 3 May 2022. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 3 Nov 2021. EUVD-2020-0173

Public exploitAdvisories link exploit code.

, 30 Oct 2026

99.6%Top 0.05%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.95%).

3.1

9.8Critical · 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 2016 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9995 20.0/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo; 1 Metasploit module; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 9.8 6.9/7

End-of-life productsupported or unknown 0.0

Total69.8

Record

Published: 6 Nov 2020
Modified: 17 Jun 2026
: CWE-78 Improper Neutralization of Special Elements used in an OS Command
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in saltPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques