Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2020-1472Netlogon Elevation of Privilege Vulnerability

Description

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Microsoft Netlogon Privilege Escalation Vulnerability.

Added
3 Nov 2021
Fix due (US federal)
3 May 2022
Used by ransomware
Known

Apply updates per vendor instructions.

ENISA's EU Vulnerability Database lists it as exploited, from CISA's KEV and ENISA's EU KEV, since 3 Nov 2021.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list a Metasploit module and an Exploit-DB entry for it. CISA's SSVC rates its exploitation: it is being exploited.

Show the exploits2

Metasploit modules1 module

Exploit-DB1 entry

Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from

Timeline

  1. ID reserved

    By microsoft

  2. · 10 months later

    Published

  3. · 15 months later

    Added to CISA KEV

    Known exploited, also by ransomware

  4. · 4 years later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2020-1472, by who scored it
Scored byCVSSScoreVector
microsoftCNA (assigner)3.1Medium5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
NVDNVD · Analyzed3.1Medium5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS (exploitation in 30 days)
99.4% · top 0.1% of all CVEs (14 Nov 2026)
CISA SSVC
Exploitation: active · Automatable: yes · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.

Affected products

References

References18

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2020-1472 badge
[![CVE-2020-1472](https://cveledger.app/badge/CVE-2020-1472.svg)](https://cveledger.app/cve/CVE-2020-1472)

Record last updated .