CVE-2020-1472: Netlogon Elevation of Privilege Vulnerability

Security readout for executives and security teams

CVE-2020-1472 is the Netlogon flaw known as Zerologon. In affected Windows Server domain controllers, an attacker on the network could gain domain administrator access without authentication. Because CISA lists it as known exploited, treat unpatched domain controllers as an urgent business risk. Exposure is concentrated in Active Directory environments running affected Windows Server domain controllers listed in the advisory, including Server 2008 R2 through Server 2019 and 20H2 variants. Linux/Samba references indicate related vendor guidance exists, but this bundle’s affected product list is Microsoft Windows Server. Escalate as an immediate identity-infrastructure risk. Domain administrator compromise can undermine the whole Windows estate, and KEV listing means exploitation is not theoretical. Remediation should be tracked to completion across every domain controller. Mitigation focus: Apply Microsoft security updates to all affected Windows Server domain controllers.; Follow Microsoft Netlogon secure channel management guidance for the phased rollout.; Inventory every domain controller, including Server Core installations..

Prepared

May 22, 2026, 05:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.