InfoSec Signals™
Sign InStart Free
Back to CVE records
Medium 5.5Known exploited (CISA KEV)Published Aug 17, 2020

CVE-2020-1472Netlogon Elevation of Privilege Vulnerability

Updated under an hour ago ()

Does this affect you?

It affects Microsoft Windows Server version 2004 and 16 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Nov 3, 2021; federal agencies had to remediate by May 3, 2022, and it is known to be used in ransomware. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

CVSS
5.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Weakness (CWE)
Not given
Known exploited
Added to CISA KEV Nov 3, 2021; federal remediation due May 3, 2022; known ransomware useApply updates per vendor instructions.
EPSS (exploitation in the next 30 days)
99.39% (percentile 100)
Assigned by
microsoft
NVD analysis
Analyzed
Record last updated
Oct 21, 2025
First seen by InfoSec Signals
Oct 9, 2026

Affected products

Affected products
Microsoft Windows Server version 2004
microsoft:windows_server_2004
from 10.0.0 before publication
CNA record
Microsoft Windows Server 2019
microsoft:windows_server_2019
from 10.0.0 before publication
CNA record
from 10.0.0 before publication
CNA record
from 10.0.0 before publication
CNA record
Microsoft Windows Server 2016
microsoft:windows_server_2016
from 10.0.0 before publication
CNA record
Microsoft Windows Server 2008 R2 Service Pack 1
microsoft:windows_server_2008_r2
from 6.1.0 before publication
CNA record
Microsoft Windows Server 2012
microsoft:windows_server_2012
from 6.2.0 before publication
CNA record
Microsoft Windows Server 2012 R2
microsoft:windows_server_2012_r2
from 6.3.0 before publication
CNA record
Microsoft Windows Server version 20H2
microsoft:windows_server_20h2
from 10.0.0 before publication
CNA record
microsoft windows_server_1903
microsoft:windows_server_1903
all versions
NVD
microsoft windows_server_1909
microsoft:windows_server_1909
all versions
NVD
microsoft windows_server_2004
microsoft:windows_server_2004
all versions
NVD
microsoft windows_server_2008
microsoft:windows_server_2008
r2
NVD
microsoft windows_server_2012
microsoft:windows_server_2012
all versions; r2
NVD
microsoft windows_server_2016
microsoft:windows_server_2016
all versions
NVD
microsoft windows_server_2019
microsoft:windows_server_2019
all versions
NVD
microsoft windows_server_20h2
microsoft:windows_server_20h2
all versions
NVD
fedoraproject fedora
fedoraproject:fedora
31; 32; 33
NVD
opensuse leap
opensuse:leap
15.1; 15.2
NVD
canonical ubuntu_linux
canonical:ubuntu_linux
14.04; 16.04; 16.04; 18.04; 20.04
NVD
synology directory_server
synology:directory_server
before 4.4.5-0101
NVD
samba samba
samba:samba
before 4.10.18; from 4.11.0 before 4.11.13; from 4.12.0 before 4.12.7
NVD
debian debian_linux
debian:debian_linux
9.0
NVD
oracle zfs_storage_appliance_kit
oracle:zfs_storage_appliance_kit
8.8
NVD

References

  • x-refsource-misc, patch, vendor-advisory
  • third-party-advisory, x-refsource-cert-vn, us-government-resource
  • mailing-list, x-refsource-mlist, third-party-advisory
  • vendor-advisory, x-refsource-ubuntu, third-party-advisory
  • vendor-advisory, x-refsource-ubuntu, third-party-advisory
  • vendor-advisory, x-refsource-fedora, mailing-list, third-party-advisory
  • vendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
  • vendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
  • vendor-advisory, x-refsource-fedora, mailing-list, third-party-advisory
  • vendor-advisory, x-refsource-fedora, mailing-list, third-party-advisory
  • vendor-advisory, x-refsource-ubuntu, third-party-advisory
  • mailing-list, x-refsource-mlist, third-party-advisory
  • vendor-advisory, x-refsource-gentoo, third-party-advisory
  • x-refsource-misc, patch, third-party-advisory
  • x-refsource-misc, third-party-advisory, vdb-entry
  • x-refsource-confirm, third-party-advisory
  • x-refsource-misc, exploit, third-party-advisory, vdb-entry
  • us-government-resource

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.