CVE-2020-1472: Microsoft Netlogon Privilege Escalation Vulnerability
Affects Microsoft NetlogonSource CISA KEV
Exploited in the wild · used in ransomware campaigns · KEV due 3 May 2022 · public exploit available (Metasploit, Exploit-DB) · 99% EPSS : apply the vendor's fix or mitigations to Microsoft Netlogon now.
Data as of 10/24/2026, 22:15:59 UTC
- Exploitation
Actively exploited – in CISA KEV since 11/03/2021
- KEV deadline
- 05/03/2022 US federal agencies must patch by this date; a sensible deadline for everyone else.
- Ransomware
- Used in ransomware campaigns
- EPSS
- 99.3% chance of exploitation in 30 days – higher than 99% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Public exploits
- 1 Metasploit module, 1 Exploit-DB entryPublic attack or detection tooling exists; see Public exploits below.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:CWhat to do
CISA required action
Apply updates per vendor instructions.
Public exploits and detection
Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.
Description
Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.
Weaknesses
- CWE-330Use of Insufficiently Random Values (opens in a new tab)
Class weaknessLikelihood of exploit: HighOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.