![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(176, 39%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETS%3C/text%3E%3C/svg%3E)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 33%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDV%3C/text%3E%3C/svg%3E)
Hello Tushar,
The Ripple20 vulnerabilities (CVE-2020-11896 through CVE-2020-11914) are tied to the Treck TCP/IP stack, which is a third-party embedded networking library used in certain IoT and industrial devices. These vulnerabilities do not affect Windows Server 2019 itself, nor Windows for Business or Windows 365 Enterprise. Microsoft’s TCP/IP implementation in Windows is entirely separate from Treck’s stack, so the Nessus report is producing a false positive when it flags these CVEs against your Windows Server installation.
To be clear: Windows Server 2019 does not ship with the Treck TCP/IP stack, and Microsoft has not released any security advisories linking Ripple20 to Windows operating systems. The Ripple20 advisories from CISA and JSOF specifically target embedded devices and OEM products that licensed Treck’s stack. If Nessus is reporting these CVEs on your Windows Server, it is misclassifying the detection. The correct remediation is to update Nessus plugins and ensure your vulnerability scanner is properly tuned to avoid mapping Ripple20 signatures to Windows hosts.
If you are running Windows Server workloads that interact with IoT or industrial devices, the Ripple20 vulnerabilities may still be relevant to those external devices, but not to the Windows Server OS itself. In that case, you would need to patch or mitigate on the device side, following vendor advisories. For Windows Server, no patch or configuration change is required because the Treck stack is not present.
I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!
Domic Vo.