Skip to content
Fencer Vulns
critical 10.0

CVE-2020-1472 kev+ ransomware in the critical feed json

Netlogon Elevation of Privilege Vulnerability

published 2020-08-17 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-12346

cvss
10.0
version 3.1, CNA
cisa kev
Exploited
added 2021-11-03, used in ransomware
epss
99.4%
EPSS 99.4% chance of exploitation in 30 days, percentile 99.9%
public exploits
2
Metasploit, Exploit-DB

Summary

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • synology directory_server 4.4.5-0101
  • samba samba 4.10.18, 4.11.13, 4.12.7
  • samba Debian 14, Debian 13, Debian 12 2:4.13.2+dfsg-2

debian advisories DEBIAN-CVE-2020-1472

  • samba Ubuntu 16.04 LTS 2:4.3.11+dfsg-0ubuntu0.16.04.31
  • samba Ubuntu 18.04 LTS 2:4.7.6+dfsg~ubuntu-0ubuntu2.20
  • samba Ubuntu 20.04 LTS 2:4.11.6+dfsg-0ubuntu1.5
  • samba Ubuntu Pro 14.04 LTS 2:4.3.11+dfsg-0ubuntu0.14.04.20+esm9

ubuntu advisories UBUNTU-CVE-2020-1472

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • samba storage 3.5 4.11.6-112.el7rhgs
  • ctdb storage 3.5 4.11.6-112.el7rhgs
  • samba-libs storage 3.5 4.11.6-112.el7rhgs
  • samba-pidl storage 3.5 4.11.6-112.el7rhgs
  • libwbclient storage 3.5 4.11.6-112.el7rhgs
  • libsmbclient storage 3.5 4.11.6-112.el7rhgs
  • samba-client storage 3.5 4.11.6-112.el7rhgs
  • samba-common storage 3.5 4.11.6-112.el7rhgs

red hat advisories RHSA-2021:3723RHBA-2021:1503RHSA-2021:1647RHSA-2020:5439

  • sca-patterns-hae SLE Module for Server Applications 15 SP3, openSUSE Leap 15.3 1.5.1-150300.10.3.1
  • sca-patterns-base SLE Module for Server Applications 15 SP3, openSUSE Leap 15.3 1.5.0-150300.10.3.1
  • sca-patterns-suma SLE Module for Server Applications 15 SP3, openSUSE Leap 15.3 1.5.0-150300.9.3.1
  • sca-server-report SLE Module for Server Applications 15 SP3, openSUSE Leap 15.3 1.5.1-150300.11.3.1
  • sca-patterns-sle11 SLE Module for Server Applications 15 SP3, openSUSE Leap 15.3 1.5.1-150300.18.3.1
  • sca-patterns-sle12 SLE Module for Server Applications 15 SP3, openSUSE Leap 15.3 1.5.1-150300.3.3.1
  • sca-patterns-sle15 SLE Module for Server Applications 15 SP3, openSUSE Leap 15.3 1.5.1-150300.14.3.1
  • samba SLE Module for Python 2 15 SP2, SLE Module for Basesystem 15 SP2, SLE High Availability Extension 15 SP2 4.11.13+git.189.e9bd318cd13-4.11.1

suse advisories SUSE-FU-2022:4496-1SUSE-SU-2020:2730-1SUSE-SU-2020:2724-1SUSE-SU-2020:2722-1SUSE-SU-2020:2721-1SUSE-SU-2020:2720-1

  • samba openSUSE Tumbleweed 4.14.6+git.182.2205d5224e3-1.1
  • sca-patterns-sle12 openSUSE Tumbleweed 1.0.8-2.2
  • sca-patterns-sle15 openSUSE Tumbleweed 1.0.8-2.2
  • samba openSUSE Leap 15.2 4.11.13+git.189.e9bd318cd13-lp152.3.13.1
  • samba openSUSE Leap 15.1 4.9.5+git.373.26895a83dbf-lp151.2.33.1

opensuse advisories openSUSE-SU-2024:11365-1openSUSE-SU-2024:11370-1openSUSE-SU-2024:11371-1openSUSE-SU-2020:1526-1openSUSE-SU-2020:1513-1

  • openchange AlmaLinux 8 2.3-27.el8

almalinux advisories ALSA-2021:1647

  • samba Rocky Linux 8 4.13.3-3.el8
  • openchange Rocky Linux 8 2.3-27.el8

rocky linux advisories RLSA-2021:1647

  • samba Alpine 3.10 4.10.18-r0
  • samba Alpine 3.11 4.11.14-r0
  • samba Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 4.12.7-r0

alpine advisories ALPINE-CVE-2020-1472

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • samba Azure Linux 3.0 4.18.3-1
  • samba CBL-Mariner 2.0 4.12.5-4

azure linux advisories AZL-36991AZL-7350

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • samba Arch Linux 4.13.0-1

arch linux advisories AVG-1236

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-1472 updated cvss 9.8

samba: Netlogon elevation of privilege vulnerability (Zerologon)

  • Red Hat Enterprise Linux 5 samba
    affected: workaround, no fix planned “This flaw can be mitigated by using "server schannel = yes" in the smb.conf configuration file.”
  • Red Hat Enterprise Linux 6 samba, samba4, samba4-dc, samba-swat, samba4-libs, samba4-pidl, +17 more
    affected: workaround, no fix available “This flaw can be mitigated by using "server schannel = yes" in the smb.conf configuration file.”
  • Red Hat CodeReady Linux Builder (v. 8) samba-devel 4.13.3-3.el8, ctdb-debuginfo 4.13.3-3.el8, samba-debuginfo 4.13.3-3.el8, libwbclient-devel 4.13.3-3.el8, samba-debugsource 4.13.3-3.el8, libsmbclient-devel 4.13.3-3.el8, +18 more Red Hat Enterprise Linux AppStream (v. 8) openchange 2.3-27.el8 Red Hat Enterprise Linux BaseOS (v. 8) ctdb 4.13.3-3.el8, samba 4.13.3-3.el8, ctdb-tests 4.13.3-3.el8, samba-libs 4.13.3-3.el8, samba-pidl 4.13.3-3.el8, samba-test 4.13.3-3.el8, +16 more
    fixed: vendor fix “This flaw can be mitigated by using "server schannel = yes" in the smb.conf configuration file.” RHSA-2021:1647
  • Red Hat Enterprise Linux Client (v. 7) samba 4.10.16-9.el7_9, samba-libs 4.10.16-9.el7_9, libwbclient 4.10.16-9.el7_9, libsmbclient 4.10.16-9.el7_9, samba-client 4.10.16-9.el7_9, samba-common 4.10.16-9.el7_9, +7 more Red Hat Enterprise Linux Client Optional (v. 7) samba 4.10.16-9.el7_9, samba-dc 4.10.16-9.el7_9, samba-pidl 4.10.16-9.el7_9, samba-test 4.10.16-9.el7_9, samba-python 4.10.16-9.el7_9, samba-dc-libs 4.10.16-9.el7_9, +4 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) samba 4.10.16-9.el7_9, samba-dc 4.10.16-9.el7_9, samba-pidl 4.10.16-9.el7_9, samba-test 4.10.16-9.el7_9, samba-python 4.10.16-9.el7_9, samba-dc-libs 4.10.16-9.el7_9, +5 more Red Hat Enterprise Linux Server (v. 7) samba 4.10.16-9.el7_9, samba-libs 4.10.16-9.el7_9, libwbclient 4.10.16-9.el7_9, libsmbclient 4.10.16-9.el7_9, samba-client 4.10.16-9.el7_9, samba-common 4.10.16-9.el7_9, +8 more Red Hat Enterprise Linux Server Optional (v. 7) samba-dc 4.10.16-9.el7_9, samba-pidl 4.10.16-9.el7_9, samba-test 4.10.16-9.el7_9, samba-python 4.10.16-9.el7_9, samba-dc-libs 4.10.16-9.el7_9, samba-test-libs 4.10.16-9.el7_9, +3 more Red Hat Enterprise Linux Server Resilient Storage (v. 7) ctdb 4.10.16-9.el7_9, ctdb-tests 4.10.16-9.el7_9
    +2 more products
    Red Hat Enterprise Linux Workstation (v. 7) samba 4.10.16-9.el7_9, samba-libs 4.10.16-9.el7_9, libwbclient 4.10.16-9.el7_9, libsmbclient 4.10.16-9.el7_9, samba-client 4.10.16-9.el7_9, samba-common 4.10.16-9.el7_9, +8 more Red Hat Enterprise Linux Workstation Optional (v. 7) samba-dc 4.10.16-9.el7_9, samba-pidl 4.10.16-9.el7_9, samba-test 4.10.16-9.el7_9, samba-dc-libs 4.10.16-9.el7_9, samba-test-libs 4.10.16-9.el7_9, samba-python-test 4.10.16-9.el7_9, +2 more
    fixed: vendor fix “This flaw can be mitigated by using "server schannel = yes" in the smb.conf configuration file.” RHSA-2020:5439
  • Red Hat Gluster 3.5 Samba on RHEL-7 ctdb 4.11.6-112.el7rhgs, samba 4.11.6-112.el7rhgs, samba-libs 4.11.6-112.el7rhgs, samba-pidl 4.11.6-112.el7rhgs, libwbclient 4.11.6-112.el7rhgs, libsmbclient 4.11.6-112.el7rhgs, +12 more
    fixed: vendor fix “This flaw can be mitigated by using "server schannel = yes" in the smb.conf configuration file.” RHSA-2021:3723
  • Red Hat Gluster 3.5 Samba on RHEL-8 ctdb 4.13.7-101.el8rhgs, samba 4.13.7-101.el8rhgs, samba-libs 4.13.7-101.el8rhgs, samba-pidl 4.13.7-101.el8rhgs, libwbclient 4.13.7-101.el8rhgs, libsmbclient 4.13.7-101.el8rhgs, +12 more
    fixed: vendor fix “This flaw can be mitigated by using "server schannel = yes" in the smb.conf configuration file.” RHBA-2021:1503

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (EDB-49071)
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
5 y ago
Patch by
2022-05-03 (4 y ago)
Ransomware
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor, product
Microsoft, Netlogon
CISA name
Microsoft Netlogon Privilege Escalation Vulnerability

Ransomware

Groups reported to have exploited it in intrusions.

  • LockBit ransomware gang
  • BlackBasta ransomware gang
  • Rhysida ransomware gang
  • BianLian ransomware gang
  • Conti ransomware gang
  • Quantum ransomware gang
  • Ryuk ransomware gang
  • RansomHub ransomware gang
  • Cuba ransomware gang
  • CosmicBeetle affiliate
  • Ghost/Cring ransomware gang
  • Fog ransomware gang
  • TheGentlemen ransomware gang

reported by cisa.govcisa.govcisa.govcisa.govcisa.govthedfirreport.comthedfirreport.comcisa.govcisa.govwelivesecurity.com

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1110 Brute Force exploitation
  • T1133 External Remote Services exploitation
  • T1021 Remote Services primary impact
  • T1068 Exploitation for Privilege Escalation primary impact
  • T1087.002 Domain Account primary impact
  • T1087.002 Domain Account secondary impact
  • T1133 External Remote Services secondary impact
  • T1486 Data Encrypted for Impact secondary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

99.39% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • Microsoft Windows Server version 2004
  • Microsoft Windows Server 2019
  • Microsoft Windows Server 2019 (Server Core installation)
  • Microsoft Windows Server, version 1909 (Server Core installation)
  • Microsoft Windows Server, version 1903 (Server Core installation)
  • Microsoft Windows Server 2016
  • Microsoft Windows Server 2016 (Server Core installation)
  • Microsoft Windows Server 2008 R2 Service Pack 1
  • Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)
  • Microsoft Windows Server 2012
  • Microsoft Windows Server 2012 (Server Core installation)
  • Microsoft Windows Server 2012 R2
  • Microsoft Windows Server 2012 R2 (Server Core installation)
  • Microsoft Windows Server version 20H2

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.