CVE-2020-1472: Microsoft Netlogon elevation of privilege via vulnerable secure channel (Zerologon)

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network exploitation yields domain administrator access, it is in CISA KEV with known ransomware use, and EPSS is near 1.0.

What it is

CVE-2020-1472 is an elevation of privilege flaw in Microsoft's Netlogon Remote Protocol (MS-NRPC) where an attacker can establish a vulnerable Netlogon secure channel connection to a domain controller. Microsoft addressed it in a phased two-part rollout modifying how Netlogon handles secure channels. It matters because a successful attack yields domain administrator access.

Impact

An unauthenticated attacker who exploits the flaw can obtain domain administrator access over the domain controller. This grants full control of the domain, enabling credential theft, persistence and lateral movement.

Attack surface

Reached over the network via MS-NRPC to a domain controller; the description states an unauthenticated attacker is required, so no credentials are needed. No user interaction is described.

Exploitation

CISA KEV lists it as actively exploited with known ransomware campaign use (Black Basta), and EPSS is 0.99389 (99.939th percentile). Public proof-of-concept and exploit references exist.

What to do

• Apply the Microsoft security updates for CVE-2020-1472 and complete both phases of the Netlogon secure channel rollout.
• Apply vendor updates for Samba, Fedora, openSUSE, Ubuntu, Debian, Synology and Oracle products listed as affected.
• Enforce Netlogon secure channel requirements and monitor for the enforcement mode transition per Microsoft guidance.
• Restrict network access to domain controllers' MS-NRPC/RPC endpoints to trusted management networks only.
• Rotate domain controller and krbtgt credentials after suspected exploitation.

Detection

• Monitor Netlogon and domain controller event logs for anomalous secure channel and machine account authentication activity.
• Alert on unexpected machine account password changes or resets originating from non-domain-controller hosts.
• Hunt for MS-NRPC traffic to domain controllers from hosts that do not normally perform Netlogon operations.
• Correlate domain controller authentication events with known Zerologon exploitation patterns and subsequent privileged account use.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.