Microsoft Windows Server Netlogon Remote Privilege Escalation Vulnerability (Zerologon, CVE-2020-1472) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTWindows Server 2008 R2 through Windows Server 2019 configured as Active Directory Domain Controllers (DCs).
An unauthenticated remote attacker can exploit the Netlogon Remote Protocol (MS-NRPC) to reset the domain controller's computer password, gaining full Domain Administrator privileges.
Apply the official Microsoft cumulative security updates and ensure Netlogon secure channel Enforcement Mode is enabled.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the latest cumulative security updates to all Windows Server Domain Controllers. Use PowerShell to force Windows Update and verify patch installation.
# Install Windows Update module and apply relevant security updates
Install-Module PSWindowsUpdate -Force -Verbose
Get-WindowsUpdate -KBArticleID KB4565349, KB4565351, KB4565354, KB4566785 -Install -AcceptAll -AutoReboot2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to Netlogon and RPC ports (TCP 135, 445, and dynamic RPC ports) using the Windows Defender Firewall.
# Block unauthorized RPC and Netlogon traffic via Windows Firewall
New-NetFirewallRule -DisplayName 'Block Unauthorized Netlogon RPC' `
-Direction Inbound `
-LocalPort 135, 445, 49152-65535 `
-Protocol TCP `
-Action Block `
-RemoteAddress 'Any' `
-Enabled True3. Log Audit & IoC Verification Commands
Monitor the Windows System Event Log for Netlogon-related warning and error events (Event IDs 5827, 5828, 5829, 5830, 5831) indicating blocked or vulnerable connections.
# Query System Event Logs for vulnerable Netlogon secure channel attempts
Get-WinEvent -LogName System | Where-Object { $_.Id -in 5827, 5828, 5829, 5830, 5831 } | `
Select-Object TimeCreated, Id, Message | Format-Table -AutoSizeBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability, widely known as 'Zerologon', is a critical privilege escalation vulnerability residing in the cryptographic implementation of the Netlogon Remote Protocol (MS-NRPC) in Microsoft Windows Server. MS-NRPC utilizes the AES-CFB8 encryption algorithm to validate session keys between clients and the Domain Controller. However, a critical design flaw exists where the Initialization Vector (IV) is hardcoded to 16 bytes of zeros. Due to this mathematical flaw, if an attacker sends a client challenge consisting entirely of zeros, there is a 1-in-256 chance that the ciphertext will also resolve to zero, bypassing authentication entirely.
2. Exploitation Mechanics & Attack Scenario
An attacker with network access to a Domain Controller can execute the exploit without any prior authentication.
- Authentication Bypass: The attacker sends repeated
NetrServerAuthenticate3requests with a client challenge of all zeros. Within approximately 256 attempts, the server accepts the spoofed credential due to the zero-IV cryptographic flaw. - Computer Password Reset: Once authenticated, the attacker calls the
NetrServerPasswordSet2API to force-reset the Domain Controller's computer account password (e.g.,DC$) to an empty or known value. - Domain Takeover: Using the compromised Domain Controller account, the attacker dumps the Active Directory database (NTDS.dit) or creates a new Domain Administrator account, achieving complete domain compromise.
3. Infrastructure & Business Impact
This vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog and holds an EPSS score of 0.9939, indicating extremely high active exploitation in the wild. Successful exploitation allows an attacker to compromise the entire corporate identity infrastructure within seconds. This leads to catastrophic business impacts, including domain-wide ransomware deployment, sensitive data exfiltration, and persistent backdoor installation.
Official Vendor Advisories & References
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.
Frequently Asked SecOps Questions (CVE-2020-1472)
FAQQ1. How critical is CVE-2020-1472 and is it actively exploited in the wild?
CVE-2020-1472 is rated CVSS 5.5 (MEDIUM) with a 30-day EPSS exploitation probability of 99.4%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-1472?
Primary impacted vendors include microsoft across windows_server. Scope summary: Windows Server 2008 R2, 2012, 2012 R2, 2016, 2019 acting as Active Directory Domain Controllers, and certain Samba configurations
Q3. What temporary mitigations or workarounds exist for CVE-2020-1472 before patching?
[Mitigation] Apply the official Microsoft cumulative security updates and ensure Netlogon secure channel Enforcement Mode is enabled. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-1472
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Windows IKE Extension Double Free Remote Code Execution Vulnerability (CVE-2026-33824)
[Affected Scope] Internet Key Exchange (IKE) Extension service running on Microsoft Windows and Windows Server operating systems
Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.