Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-1472

99
FAUCET Score

CVE-2020-1472, widely known as ZeroLogon, is a critical elevation of privilege vulnerability within the Netlogon Remote Protocol (MS-NRPC) affecting Microsoft Windows Domain Controllers and Samba implementations. With a maximum CVSS score of 10.0, this flaw permits an unauthenticated attacker with network access to easily establish a vulnerable secure channel and escalate to domain administrator privileges, effectively compromising the entire network. The vulnerability is currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog due to active use in ransomware campaigns, and public exploit modules are readily available in tools such as Metasploit.

Impacted Technologies

VendorProductVersion(s)CPE
All Versions ImpactedCPE matchmatch criteria
cpe:2.3:o:microsoft:windows_server_1903:*:*:*:*:*:*:*:*
All Versions ImpactedCPE matchmatch criteria
cpe:2.3:o:microsoft:windows_server_1909:*:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:o:microsoft:windows_server_2004:-:*:*:*:*:*:*:*
r2CPE matchmatch criteria
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.5MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
1.8
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
99.51%
Probability of exploitation in next 30 days
EPSS Percentile
99.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
Added to KEV · Nov 3, 2021
ExploitDB: EDB-49071 · Nov 18, 2020
This CVE's current EPSS score of 0.9951 is in the 100th percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (27)

denopatch availablevia llm_extracted
Fixed in: v20200813 or higher
View patch
invoiceplanepatch availablevia llm_extracted
Fixed in: v20200813 or higher
View patch
microsoftpatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: Windows Server, version 1909 (Server Core installation)
View patch
microsoftpatch availablevia msrc
Product: Windows Server, version 1903 (Server Core installation)
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2016
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2016 (Server Core installation)
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2008 R2 for x64-based Systems Service Pack 1
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2012
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2012 (Server Core installation)
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2012 R2
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2012 R2 (Server Core installation)
View patch
microsoftpatch availablevia msrc
Product: Windows Server, version 2004 (Server Core installation)
View patch
microsoftpatch availablevia msrc
Product: Windows Server, version 20H2 (Server Core Installation)
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2019
View patch
microsoftpatch availablevia msrc
Product: Windows Server 2019 (Server Core installation)
View patch
oraclepatch availablevia nvd_reference
View patch
pjsippatch availablevia llm_extracted
Fixed in: v20200813 or higher
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Gluster Storage 3.5 for RHEL 7Fixed in: samba-0:4.11.6-112.el7rhgs
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Gluster Storage 3.5 for RHEL 8Fixed in: samba-0:4.13.7-101.el8rhgs
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: openchange-0:2.3-27.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: samba-0:4.13.3-3.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: samba-0:4.10.16-9.el7_9
View patch
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: samba
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: samba4
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: samba

Vendor Advisories (5)

redhatCVE-2020-1472Critical

samba: Netlogon elevation of privilege vulnerability (Zerologon)

Sep 11, 2020
denollm-deno-d17021b1d707a449CRITICAL

Windows Server Netlogon Remote Protocol Vulnerability (Zerologon)

Aug 17, 2020
microsoft2020-Aug/CVE-2020-1472Critical

Netlogon Elevation of Privilege Vulnerability

Aug 11, 2020
pjsipllm-pjsip-15fc1e7642a2c0d2CRITICAL

Windows Server Netlogon Remote Protocol Vulnerability (Zerologon)

Aug 1, 2020
invoiceplanellm-invoiceplane-a4bac5309601fa0aCRITICAL

A vulnerability in Windows Server allows attackers to use Netlogon Remote Protocol to run a specially-crafted application on a device on the network.

References

cisa.gov / known-exploited-vulnerabilities-catalog
US Government Resource
lists.opensuse.org / opensuse-security-announce/2020-09/msg00080.html
Mailing ListThird Party Advisory
lists.opensuse.org / opensuse-security-announce/2020-09/msg00086.html
Mailing ListThird Party Advisory
packetstormsecurity.com / files/159190/Zerologon-Proof-Of-Concept.html
Third Party AdvisoryVDB Entry
packetstormsecurity.com / files/160127/Zerologon-Netlogon-Privilege-Escalation.html
ExploitThird Party AdvisoryVDB Entry
lists.debian.org / debian-lts-announce/2020/11/msg00041.html
Mailing ListThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3
Mailing ListThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B
Mailing ListThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP
Mailing ListThird Party Advisory
portal.msrc.microsoft.com / en-US/security-guidance/advisory/CVE-2020-1472
PatchVendor Advisory
security.gentoo.org / glsa/202012-24
Third Party Advisory
usn.ubuntu.com / 4510-1
Third Party Advisory
usn.ubuntu.com / 4510-2
Third Party Advisory
usn.ubuntu.com / 4559-1
Third Party Advisory
kb.cert.org / vuls/id/490028
Third Party AdvisoryUS Government Resource
oracle.com / security-alerts/cpuApr2021.html
PatchThird Party Advisory
synology.com / security/advisory/Synology_SA_20_21
Third Party Advisory
openwall.com / lists/oss-security/2020/09/17/2
Mailing ListThird Party Advisory