CVE-2020-1472

ENISA EUVD: EUVD-2020-12346 ↗
Exploited in the Wild ✓ Confirmed 0-Day
Triaged: March 5, 2026 16 articles Published: 2020-08-17

EPSS Score

Source: FIRST.org · 2026-05-23
94.38%
probability
This CVE has a 94.38% probability of being exploited in the next 30 days.
0% Top 100.0th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)
5.5
MEDIUM
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Temporal
Exploit Code Maturity
Proof-of-Concept
Remediation Level
Official Fix
Report Confidence
Confirmed
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C

CVSS v2 (legacy)

9.3
HIGH
Access Vector
Network
Access Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
AV:N/AC:M/Au:N/C:C/I:C/A:C

Description

NVD
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

Affected Products

Microsoft
Windows Server version 2004
10.0.0
Microsoft
Windows Server 2019
10.0.0
Microsoft
Windows Server 2019 (Server Core installation)
10.0.0
Microsoft
Windows Server, version 1909 (Server Core installation)
10.0.0
Microsoft
Windows Server, version 1903 (Server Core installation)
10.0.0

Exploits & PoC

bvcyber/CVE-2020-1472

Test tool for CVE-2020-1472

1819 2025-06-27
dirkjanm/CVE-2020-1472

PoC for Zerologon - all research credits go to Tom Tervoort of Secura

1298 2020-11-03
risksense/zerologon

Exploit for zerologon cve-2020-1472

687 2020-10-15
VoidSec/CVE-2020-1472

Exploit Code for CVE-2020-1472 aka Zerologon

392 2020-11-05
bb00/zer0dump

Abuse CVE-2020-1472 (Zerologon) to take over a domain and then repair the local stored machine account password.

180 2023-03-02
mstxq17/cve-2020-1472

cve-2020-1472 复现利用及其exp

112 2020-09-16
Rvn0xsy/ZeroLogon

CVE-2020-1472 C++

84 2022-09-02
zeronetworks/zerologon

Test script for CVE-2020-1472 for both RPC/TCP and RPC/SMB

61 2023-05-01
k8gege/CVE-2020-1472-EXP

Ladon Moudle CVE-2020-1472 Exploit 域控提权神器

58 2020-09-15
Privia-Security/ADZero

Zerologon AutoExploit Tool | CVE-2020-1472

22 2020-10-02
sho-luv/zerologon

Zerologon Check and Exploit - Discovered by Tom Tervoort of Secura and expanded on @Dirkjanm's cve-2020-1472 coded example. This tool will check, expl

18 2022-04-12
WiIs0n/Zerologon_CVE-2020-1472

POC for checking multiple hosts for Zerologon vulnerability

11 2020-10-05
B34MR/zeroscan

Zeroscan is a Domain Controller vulnerability scanner, that currently includes checks for Zerologon (CVE-2020-1472), MS-PAR/MS-RPRN and SMBv2 Signing.

11 2022-04-09
sv3nbeast/CVE-2020-1472

CVE-2020-1472复现时使用的py文件整理打包

10 2022-12-03
thatonesecguy/zerologon-CVE-2020-1472

PoC for Zerologon (CVE-2020-1472) - Exploit

8 2020-09-16
YossiSassi/ZeroLogon-Exploitation-Check

quick'n'dirty automated checks for potential exploitation of CVE-2020-1472 (aka ZeroLogon), using leading artifects in determining an actual exploitat

7 2021-01-08
CPO-EH/CVE-2020-1472_ZeroLogonChecker

C# Vulnerability Checker for CVE-2020-1472 Aka Zerologon

5 2021-07-20
NAXG/CVE-2020-1472

CVE-2020-1472复现流程

4 2021-04-18
guglia001/MassZeroLogon

Tool for mass testing ZeroLogon vulnerability CVE-2020-1472

3 2022-09-30
0xkami/CVE-2020-1472

CVE-2020-1472漏洞复现过程

2 2020-09-15
CanciuCostin/CVE-2020-1472

CVE-2020-1472 - Zero Logon vulnerability Python implementation

2 2020-09-16
0xcccc666/cve-2020-1472_Tool-collection

cve-2020-1472_Tool collection

2 2020-09-16
rhymeswithmogul/Set-ZerologonMitigation

Protect your domain controllers against Zerologon (CVE-2020-1472).

2 2020-09-30
wrathfulDiety/zerologon

zerologon script to exploit CVE-2020-1472 CVSS 10/10

2 2021-01-03
mods20hh/ZeroLogon-PoC-DC-Pwn

Zerologon (CVE-2020-1472) Proof-of-Concept application - Critical Active Directory vulnerability exploitation tool.

2 2026-05-23
1 2020-09-15
McKinnonIT/zabbix-template-CVE-2020-1472

Zabbix Template to monitor for Windows Event Viewer event's related to Netlogon Elevation of Privilege Vulnerability - CVE-2020-1472. Monitors event I

1 2020-09-16
murataydemir/CVE-2020-1472

[CVE-2020-1472] Netlogon Remote Protocol Call (MS-NRPC) Privilege Escalation (Zerologon)

1 2020-09-16
npocmak/CVE-2020-1472

https://github.com/dirkjanm/CVE-2020-1472

1 2020-09-16
midpipps/CVE-2020-1472-Easy

A simple implementation/code smash of a bunch of other repos

1 2020-09-19
hell-moon/ZeroLogon-Exploit

Modified the test PoC from Secura, CVE-2020-1472, to change the machine password to null

1 2021-03-01
Udyz/Zerologon

Exploit Code for CVE-2020-1472 aka Zerologon

1 2021-04-07
Anonymous-Family/Zero-day-scanning

Zero-day-scanning is a Domain Controller vulnerability scanner, that currently includes checks for Zero-day-scanning (CVE-2020-1472), MS-PAR/MS-RPRN a

1 2022-03-03
grupooruss/CVE-2020-1472

CVE 2020-1472 Script de validación

0 2020-09-24
0 2020-11-17
maikelnight/zerologon

Check for events that indicate non compatible devices -> CVE-2020-1472

0 2020-11-11
JayP232/The_big_Zero

The following is the outcome of playing with CVE-2020-1472 and attempting to automate the process of gaining a shell on the DC

0 2020-12-04
Anonymous-Family/CVE-2020-1472

Test tool for CVE-2020-1472

0 2023-05-01
carlos55ml/zerologon

Set of scripts, to test and exploit the zerologon vulnerability (CVE-2020-1472).

0 2022-03-29
likeww/MassZeroLogon

Tool for mass testing ZeroLogon vulnerability CVE-2020-1472

0 2022-09-30
c3rrberu5/ZeroLogon-to-Shell

This is a combination of the zerologon_tester.py code (https://raw.githubusercontent.com/SecuraBV/CVE-2020-1472/master/zerologon_tester.py) and the to

0 2023-08-14
logg-1/0logon

MS-NRPC (Microsoft NetLogon Remote Protocol)/CVE-2020-1472

0 2024-01-07
metehangelgi/CVE-2020-1472-LAB

Lab introduction to ZeroLogon

0 2024-02-11
blackh00d/zerologon-poc

A script to exploit CVE-2020-1472 (Zerologon)

0 2024-06-06
TuanCui22/ZerologonWithImpacket-CVE2020-1472

A practical proof-of-concept for CVE-2020-1472 (Zerologon) using the Impacket library to exploit Netlogon vulnerability and perform unauthorized domai

0 2024-12-28
PakwanSK/Simulating-and-preventing-Zerologon-CVE-2020-1472-vulnerability-attacks.

Simulation of the Zerologon (CVE-2020-1472) vulnerability attack in Active Directory on Windows Server 2016 and the use of the Trend Micro Deep Securi

0 2025-03-07
100HnoMeuNome/ZeroLogon-CVE-2020-1472-lab

Explicação e demonstração da vulnerabilidade ZeroLogon (CVE-2020-1472)

0 2025-10-10
nyambiblaise/Domain-Controller-DC-Exploitation-with-Metasploit-Impacket

End-to-end Domain Controller exploitation using Metasploit and Impacket: discovered DC10, exploited Zerologon (CVE-2020-1472), extracted NTLM hashes,

0 2025-10-18
commit2main/zerologon-lab

Scripts for a lab environment demonstrating the Zerologon (CVE-2020-1472) vulnerability.

0 2025-12-07
noemvex/apex-predator

Advanced AD Offensive Engine. Automates the path from stealthy recon to domain compromise. Features unauthenticated SMB Signing/NTLM Relay audits, Zer

0 2026-04-10
74 repos — triés par ⭐ Rechercher sur GitHub ↗

Signal Intelligence

Confidence
92%
EPSS 94.38%
CVSS v3.1 5.5
Mentions 16
Last Seen May 08, 2025

CNA Information

CNA Assigner
microsoft
CNA Title
Netlogon Elevation of Privilege Vulnerability

Analyst Note

CVE-2020-1472 (Zerologon) is a confirmed zero-day with widespread in-the-wild exploitation documented in 2020. Active attacks against domain controllers occurred immediately after disclosure, with exploitation preceding comprehensive patch availability across all affected systems. CERT-EU's urgent security advisory confirms critical exploitation in the wild.

Threat Actors 56

MuddyWater
apt_group Information theft and espionage 🇮🇷 IR
Lazarus Group
apt_group Information theft and espionage 🇰🇵 KP
Turla Group
apt_group Information theft and espionage Russian Federation
APT 29
apt_group Information theft and espionage 🇷🇺 RU
DarkHotel
apt_group Information theft and espionage 🇰🇷 KR
WIZARD SPIDER
apt_group Financial gain 🇷🇺 RU
Cobalt
apt_group Financial crime 🇷🇺 RU
APT37
apt_group Information theft and espionage 🇰🇵 KP
FIN7
apt_group Financial crime 🇷🇺 RU
APT32
apt_group Information theft and espionage 🇻🇳 VN
Cron
apt_group 🇷🇺 RU
SaintBear
apt_group Information theft and espionage 🇷🇺 RU
CHRYSENE
apt_group Information theft and espionage 🇮🇷 IR
Careto
apt_group Information theft and espionage 🇪🇸 ES
Leviathan
apt_group Information theft and espionage 🇨🇳 CN
BelialDemon
apt_group 🇷🇺 RU
Hacking Team
apt_group 🇮🇹 IT
Energetic Bear
apt_group Information theft and espionage 🇷🇺 RU
Nitro
apt_group Information theft and espionage 🇨🇳 CN
MAGNALLIUM
apt_group Sabotage and destruction 🇮🇷 IR
Ice Fog
apt_group Information theft and espionage 🇨🇳 CN
DNSpionage
apt_group Information theft and espionage 🇮🇷 IR
Kinsing
apt_group 🇷🇺 RU
HAZY TIGER
apt_group Information theft and espionage 🇮🇳 IN
TA505
apt_group Financial gain 🇷🇺 RU
Infy
apt_group Information theft and espionage 🇮🇷 IR
Naikon
apt_group Information theft and espionage 🇨🇳 CN
Wekby
apt_group Information theft and espionage 🇨🇳 CN
Evilnum
apt_group Information theft and espionage
TeamTNT
apt_group 🇩🇪 DE
ProjectSauron
apt_group Information theft and espionage 🇺🇸 US
Predatory Sparrow
apt_group Sabotage and destruction 🇮🇱 IL
PROMETHIUM
apt_group Information theft and espionage 🇹🇷 TR
Silence group
apt_group Financial crime 🇷🇺 RU
Pirate Panda
apt_group Information theft and espionage 🇨🇳 CN
GhostNet
apt_group Information theft and espionage 🇨🇳 CN
LUNAR SPIDER
apt_group 🇷🇺 RU
RAZOR TIGER
apt_group Information theft and espionage 🇮🇳 IN
RomCom
apt_group Financial gain 🇷🇺 RU
Putter Panda
apt_group Information theft and espionage 🇨🇳 CN
NetTraveler
apt_group Information theft and espionage 🇨🇳 CN
El Machete
apt_group Information theft and espionage 🇻🇪 VE
TeamXRat
apt_group 🇧🇷 BR
IXESHE
apt_group Information theft and espionage 🇨🇳 CN
Anchor Panda
apt_group Information theft and espionage 🇨🇳 CN
GCMAN
apt_group Financial crime 🇷🇺 RU
PowerPool
apt_group Information theft and espionage 🇷🇺 RU
Blue Termite
apt_group Information theft and espionage 🇨🇳 CN
Blackgear
apt_group Information theft and espionage 🇨🇳 CN
GC01
apt_group Financial gain 🇨🇦 CA
Rocke
apt_group 🇨🇳 CN
RedAlpha
apt_group Information theft and espionage 🇨🇳 CN
Scarab
apt_group Information theft and espionage 🇨🇳 CN
ZooPark
apt_group Information theft and espionage 🇮🇷 IR
Operation Shadow Force
apt_group 🇨🇳 CN
DEV-0586
apt_group Sabotage and destruction 🇷🇺 RU

Triage Info

Decided atMar 05, 2026
Published DateAug 17, 2020