CVE-2020-1472: Zerologon
Is CVE-2020-1472 real, exploitable, or a false positive? Here's the community verdict.
signals
public sources
Confirmed exploited in the wild. Patch this first, regardless of the base score.
public exploits
links to sources — we don’t host codeA working exploit is publicly available from a maintained source. Treat this as higher urgency and verify your exposure.
baseline read
auto · not a community verdict
Real — exploited in the wild
CISA confirms active exploitation. Treat scanner hits as true positives unless your specific version or config is unaffected.
Based on CISA KEV
Confirm or dispute →CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.
References
Published
Embed this verdict
[](https://www.truepositive.app/cve/CVE-2020-1472)<a href="https://www.truepositive.app/cve/CVE-2020-1472"><img src="https://www.truepositive.app/cve/CVE-2020-1472/badge.svg" alt="TruePositive verdict for CVE-2020-1472"></a>Live badge that updates automatically as the community verdict changes.
Community ground truth
Be the first practitioner to weigh in
So far this is only TruePositive's editorial baseline from public sources. Add your real-world verdict below — it becomes the signal the next person triaging this relies on.
🥇 The first 50 practitioners to contribute earn a Founding Contributor badge.
In your experience, is this finding real and exploitable?
awaiting field verdictsCurated baseline: TruePositive's read from public sources is Real & exploitable — a starting point, not a community verdict.
No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.
Field notes & remediation
Verdicts are the quick signal. Notes are the evidence and fixes behind them.
- 0
A flaw in the Netlogon protocol lets an attacker on the internal network reset a Domain Controller's machine account password to empty and take over the whole Active Directory domain in seconds. No login is needed, just network access to the DC. It is one of the fastest paths from a small foothold to full domain compromise.
Who is affected: unpatched Windows Domain Controllers.
How to check: confirm the August 2020 patch is installed and that you have moved to enforcement mode. A public tester exists, but run it carefully against your own DCs only.
Commonly flagged by: Nessus, Qualys, Rapid7, Microsoft Defender.
- 0
Apply the August 2020 patch and move to enforcement mode. The safe order is to patch, then watch for devices still using vulnerable Netlogon connections so you do not break legacy kit, then turn on enforcement. If a DC was exposed and unpatched, treat it as a possible full-domain compromise and investigate.
Add a field note or remediationoptional
Related CVEs
Same weakness: CWE-330.