Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

CVE-2020-1472

Known ransomware campaign use. CISA's KEV catalog lists this CVE as used in ransomware attacks.
CISA KEV
Exploited
Ransomware Use
CVSS 3.1 Score
5.5
MEDIUM
EPSS Score
99.39%
EPSS Percentile
99.9%
as of 2026-10-05
NVD Status
Analyzed
Published 2020-08-17
Description

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

Affected Vendors / Products
Microsoft Windows Server 1903
Microsoft Windows Server 1909
Microsoft Windows Server 2004
Microsoft Windows Server 2008
Microsoft Windows Server 2012
Microsoft Windows Server 2016
Microsoft Windows Server 2019
Microsoft Windows Server 20H2
Fedoraproject Fedora
Opensuse Leap
Canonical Ubuntu Linux
Synology Directory Server
Samba Samba
Debian Debian Linux
Oracle Zfs Storage Appliance Kit
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE)
NVD-CWE-noinfo
Last Modified
2026-06-17
CVSS 3.1 Vector Breakdown
CISA Vulnrichment (SSVC)
Exploitation: active Automatable: yes Technical Impact: total
Source: vulnerability-lookup.org
Exploitation Intelligence (3 sources)
Source Exploited Ransomware Use Notes
enisa-cnw-kev Yes — Affected: Microsoft / Netlogon (ZeroLogon) | Exploitation type: ransomware | Origin source: cnw
cisa-kev Yes Known KEV entry: Microsoft Netlogon Privilege Escalation Vulnerability | Affected: Microsoft / Netlogon | Description: Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Known | Notes (KEV): Reference CISA's ED 20-04 (https://www.cisa.gov/news-events/directives/ed-20-04-mitigate-netlogon-elevation-privilege-vulnerability-august-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-04. https://nvd.nist.gov/vuln/detail/CVE-2020-1472
kevintel Yes Known KEVIntel entry: Netlogon Elevation of Privilege Vulnerability | Affected: Microsoft / Windows Server version 2004, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server, version 1909 (Server Core installation), Windows Server, version 1903 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server version 20H2 | CVSS: 5.5 (MEDIUM) | EPSS: 0.99512 | Used in malware: yes | Not yet in CISA KEV: False
Correlated via CISA KEV, Shadowserver & KEVIntel.com. Source: vulnerability-lookup.org
Vendor Exploitability (VEX) (2 statements)
Vendor Source Status Statement
Red Hat CSAF VEX fixed (1587) known affected (30) As per upstream samba domain controllers (AD and NT4-like) can be impacted by the ZeroLogon CVE-2020-1472. Samba packages shipped with Red Hat Gluster Storage 3, Red Hat Enterprise Linux 7 and 8 are not vulnerable by default, since they have "server schannel" enabled by default in its configuration file.
SUSE CSAF VEX known affected (1144) known not affected (4) recommended (4395) —
Source: vulnerability-lookup.org
Detection Rules (20)
sagan [EXTRAHOP] CVE-2020-1472 Zerologon Scan
sagan [EXTRAHOP] CVE-2020-1472 Zerologon Exploit Attempt
sigma Zerologon Exploitation Using Well-known Tools
This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.
sigma Vulnerable Netlogon Secure Channel Connection Allowed
Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.
sigma Potential Zerologon (CVE-2020-1472) Exploitation
Detects potential Netlogon Elevation of Privilege Vulnerability aka Zerologon (CVE-2020-1472)
splunk Detect Computer Changed with Anonymous Account
The following analytic detects changes to computer accounts using an anonymous logon. It leverages Windows Security Event Codes 4742 (Computer Change) with a SubjectUserName of a value "ANONYMOUS LOGON". This activity can be significant because anonymous logons should not typically be modifying computer accounts, indicating potential unauthorized access or misconfiguration. If confirmed malicious, this could allow an attacker to alter computer accounts, potentially leading to privilege escalation or persistent access within the network.
splunk Detect Zerologon via Zeek
The following analytic detects attempts to exploit the Zerologon CVE-2020-1472 vulnerability via Zeek RPC. It leverages Zeek DCE-RPC data to identify specific operations: NetrServerPasswordSet2, NetrServerReqChallenge, and NetrServerAuthenticate3. This activity is significant because it indicates an attempt to gain unauthorized access to a domain controller, potentially leading to a complete takeover of an organization's IT infrastructure. If confirmed malicious, the impact could be severe, including data theft, ransomware deployment, or other devastating outcomes. Immediate investigation of the identified IP addresses and RPC operations is crucial.
sigma Vulnerable Netlogon Secure Channel Connection Allowed
Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.
sigma Zerologon Exploitation Using Well-known Tools
This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.
sigma Potential Zerologon (CVE-2020-1472) Exploitation
Detects potential Netlogon Elevation of Privilege Vulnerability aka Zerologon (CVE-2020-1472)
+10 more on rulezet.org
Source: vulnerability-lookup.org
Exploited By Ransomware Groups (4)
Ransomware Group Vendor Product Source
BlackBasta Windows NetLogon cisa.gov
LockBit Windows NetLogon cisa.gov
RansomHub Windows NetLogon cisa.gov
thegentlemen Windows NetLogon checkpoint.com
References
View on CVE.org · View on NVD