CVE-2020-1472

Netlogon Elevation of Privilege Vulnerability

Exploited in the wild. In CISA KEV since 2021‑11‑03. A vendor fix is available.

CVSS 3.15.5Medium EPSS percentile99th99% chance in 30 days CISA KEVListedsince 2021-11-03, due 2022-05-03
Public exploit: 2 sources FixVendor fixNo build named by the sources

Published 2020-08-17Updated 2026-02-23Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Identify every Windows Server domain controller and any Samba or Directory Server system handling domain logins.
For Samba, upgrade to 4.10.18 or later; for Directory Server, upgrade to 4.4.5-0101 or later.
For Windows Server, install the security updates published in Microsoft's CVE-2020-1472 advisory and follow its Netlogon compatibility guidance.
Until every affected server is updated, restrict network access to domain controllers to only required internal systems.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

In plain language

Written by AI from the record

This is a serious flaw in Windows Server domain controllers, Samba, and Directory Server that attackers have used in ransomware campaigns, so small businesses running these systems should act now.

Unauthenticated elevation of privilege via a crafted Netlogon Remote Protocol (MS-NRPC) secure-channel connection to a domain controller can grant domain administrator access.

If you're affected

Full domain takeover
Ransomware deployment
Business system disruption
Sensitive data exposure

What is it

This weakness can let an outsider on your network obtain the highest level of control over a company’s central login system. It is like someone finding a way to mint a master key that opens every office and filing cabinet in the building.

Who is affected

This matters if you run windows server as a domain controller, or use samba or directory server to manage company logins and computers. It is especially important for servers that handle central user accounts. It is only a risk when an attacker can reach the domain controller over the network.

How urgent is it

Attackers are already exploiting this flaw in ransomware campaigns, and it is listed by CISA as a known exploited vulnerability. Treat this as an urgent incident-prevention task: update exposed and internal domain controllers without delay.

What to do — in detail

Confirm exposure by inventorying all domain controllers and systems running Samba or Directory Server, then determine their installed versions and whether they accept Netlogon secure-channel connections.

Target Samba 4.10.18 or later and Directory Server 4.4.5-0101 or later. For Windows Server 2008 R2, 2012, 2012 R2, 2016, and 2019, install the Microsoft updates published for CVE-2020-1472 and follow the advisory’s phased Netlogon secure-channel rollout guidance; the findings do not provide individual Windows update package numbers.

Test older devices, applications, and non-Windows domain members for Netlogon compatibility before enforcing changes broadly, because the rollout may reject insecure connections. If patching is delayed, limit network paths to domain controllers to required internal hosts only and isolate unnecessary access. CISA’s remediation due date was 2022-05-03. Review Netlogon secure-channel compatibility events and investigate failed or insecure connection attempts during and after rollout.

Technical context

CVE-2020-1472 is a Netlogon elevation-of-privilege vulnerability affecting MS-NRPC secure-channel handling. An unauthenticated network attacker can connect to a vulnerable domain controller with a crafted request and obtain domain administrator access. CISA KEV lists confirmed exploitation in ransomware campaigns, and two public exploits are known. EPSS prediction is superseded by the confirmed exploitation evidence. CVSS 3.1 is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), although the technical description identifies an unauthenticated MS-NRPC path to a reachable domain controller.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Listed as exploited in the wild since 2021-11-03.

US federal agencies must remediate by 2022-05-03.

Known use in ransomware campaigns.

Apply updates per vendor instructions.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

99% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 11 days before any public exploit.

2026-06-25OpenVAS check added
2026-03-06Public exploit / PoCsource: packetstorm
2026-02-23Patch availablerecord updated
2021-11-03Added to CISA KEVransomware campaign
2020-08-17Publishedweakness classified

Affected products

Microsoft Corpcommercial · USaka microsoft, microsoft corporation
fedoraprojectoss-project · USaka fedora project
- fedoraOSOn-premOperating Systems / linux-distro
opensuseoss-project · DE
- leapOSOn-premOperating Systems / linux-distro
Canonical Ltd.commercial · GBaka canonical
- UbuntuOSOn-premOperating Systems / linux-distro
synologycommercial · USaka diskstation manager (dsm), router manager
- directory serverOn-premDatabases / relational
sambaoss-project · DE
- sambaLibraryLibraryOperating Systems / unix-bsd

And 38 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Scored 5.5 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact

Weaknesses

NVD-CWE-noinfoNo name in the record

Sources

References in the record

And 29 more references. See all after sign-in

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Microsoft, not every advisory. This one: actively exploited.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account