KEV: Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.
NVD: An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.
To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.
Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.
For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020).
When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.
warncomponent_extraction: Component 'Netlogon Remote Protocol (MS-NRPC) secure channel connection handling in Netlogon.dll' matches or contains product name 'Netlogon' — no specific component identified
Hunting hypothesis agent
Hunt DC event logs for Security 4742 password changes on the DC machine account and Netlogon 5827-5831 denials, or IDS alerts for MS-NRPC NetrServerAuthenticate2/PasswordSet2 calls with all-zero client credentials.
Research details
ComponentNetlogon Remote Protocol (MS-NRPC) secure channel connection handling in Netlogon.dll
PreconditionsThe attacker must have network access to a vulnerable Domain Controller on port 445 or directly via MS-NRPC over RPC. No prior authentication is required - the exploit is completely unauthenticated, sending specially crafted Netlogon requests with a zero-computed session key (16 null bytes) to bypass AES-CFB8 encryption verification. The target Domain Controller must be running a Windows Server version prior to the August 2020 security updates (or the February 2021 phase 2 updates) that lack the Netlogon secure channel hardening changes. Successful exploitation resets the Domain Controller's machine account password to an empty string, enabling subsequent DCSync attacks to extract all domain credentials. agent
Exploit notesThe exploit is straightforward to execute using publicly available Python scripts (e.g., dirkjanm's PoC with 1300+ GitHub stars). An unauthenticated attacker with network access to a Domain Controller can fully compromise the Active Directory domain in seconds. Although Microsoft's CVSS rating is 5.5 (AV:L), NVD correctly assigns CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflecting the true network-based criticality. Widely exploited by ransomware groups including Ryuk and Conti, and remains a primary initial access vector for AD compromises.
SummaryCVE-2020-1472, known as Zerologon, is a critical privilege escalation vulnerability in the Netlogon Remote Protocol (MS-NRPC) discovered by Tom Tervoort of Secura. The flaw allows an unauthenticated attacker with network access to a Domain Controller to completely bypass Netlogon authentication by sending a Secure Channel connection request with a zero-computed credential hash (16 bytes of zeros as the AES-CFB8 session key). Successful exploitation resets the Domain Controller's machine account password, enabling the attacker to then perform DCSync attacks to extract all Active Directory credential hashes and gain domain admin privileges. The vulnerability was widely exploited in the wild following public disclosure in September 2020, with numerous working PoCs available and active use by ransomware operations throughout 2020-2022.
Tia coverage
First reported2026-05-24
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.