Critical Netlogon Privilege Escalation (CVE‑2020‑1472 “Zerologon”) Threatens Domain Controllers
What It Is – CVE‑2020‑1472 is a privilege‑escalation flaw in Microsoft’s Netlogon Remote Protocol (MS‑NRPC). An attacker who establishes a vulnerable Netlogon secure channel to a domain controller can impersonate any computer and obtain domain‑admin rights.
Exploitability – Public exploits and proof‑of‑concept code exist; the vulnerability scores 10.0 (Critical) on the CVSS v3.1 scale.
Affected Products – Microsoft Windows Server (2012 R2, 2016, 2019, 2022) domain controllers that have not applied the security update released in August 2020.
Why It Matters for Trust & Control Assurance
- Identity & Access Management – The flaw bypasses authentication controls, directly violating the control objective of protecting privileged accounts.
- Continuous Monitoring – Detecting anomalous Netlogon channel activity is essential evidence for an audit trail and for demonstrating due‑diligence.
- Patch Management Evidence – Maintaining up‑to‑date domain‑controller patches is a core control that maps to multiple frameworks (e.g., NIST CSF Protect, ISO 27001 A.12.6).
Recommended Actions
- Deploy Microsoft’s security update (KB4528760 or later) to all domain controllers immediately.
- Verify that the Netlogon secure channel is hardened; enable logging of Netlogon authentication events and monitor for abnormal patterns.
- Capture remediation evidence (patch version, log snapshots) to satisfy audit requirements and support continuous control assurance.
Source: CISA KEV – CVE‑2020‑1472