CVE-2020-1472 (“Zerologon”) is an elevation-of-privilege vulnerability in the Netlogon Remote Protocol (MS-NRPC). A flaw in how the protocol applied AES-CFB8 encryption allowed an unauthenticated attacker with a network path to a domain controller to impersonate any machine — including the DC itself — and reset its Active Directory machine-account password to an empty value, yielding full domain compromise.
Why it matters for identity teams. Active Directory is the root of trust for most enterprise networks. A single unpatched DC reachable on the network was enough to take over every account in the domain. It became one of the most-exploited vulnerabilities of its era and prompted a U.S. CISA emergency directive.
What to take away:
- Apply the Netlogon enforcement updates and move DCs to enforcement mode.
- Restrict network reachability of domain controllers.
- Continuously verify that AD account and machine-credential state matches policy — drift is exactly the kind of signal that flags abuse early.
This is a seed entry illustrating the Knowledge Center format. Read the full advisory at the primary source linked above, and CISA’s Known Exploited Vulnerabilities catalog.