CVE-2020-1472Vulnerability
Microsoft Netlogon Privilege Escalation Vulnerability
Reported by 7 independent sources · first reported by Group-IB · last reported
Last reported 4 days ago
Fix due 3 May 2022
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 24 Oct 2026
What the reports say
8 reports, newest first · the exact sentence from each-
INC and The Gentlemen Ransomware: Exposed AI Infrastructure“CVE-2020-1472 (ZeroLogon)Windows NetlogonAttempted”
-
Federal & Mission-Critical Security Validation“In a documented Horizon3 engagement modeled on Iranian threat actor tradecraft, NodeZero® identified Zerologon (CVE-2020-1472) on a critical domain controller within hours.”
-
Berlin Data Leak: What Rhysida Published, and What Is Still Unresolved“…VPN endpoints with valid stolen credentials at organizations that had not enforced multifactor authentication, along with Zerologon (CVE-2020-1472) and ordinary phishing.”
-
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use“We also observed traces suggesting the exploitation of CVE-2020-1472 (Zerologon) and the vulnerabilities associated with MS17-010.”
-
August 2026 CVE Landscape“CVE-2020-1472”
-
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion“They then used a custom tool that used the Zerologon (CVE-2020-1472) vulnerability to attempt additional lateral movement to a second domain controller.”
-
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs“CVE-2020-1472”
-
RansomHub Never Sleeps Episode 1: The evolution of modern ransomware“…his technique allowed the attacker to exploit two vulnerabilities in the domain controller: CVE-2021-42278 (sAMAccount Spoofing) and CVE-2020-1472.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2021-42278, CVE-2025-49113, CVE-2017-5753, CVE-2022-27925, CVE-2024-3400, CVE-2026-68820, CVE-2026-65400, CVE-2026-60004, CVE-2026-64849, CVE-2026-33824, CVE-2026-35616, CVE-2026-0300, CVE-2026-33017, CVE-2017-11882, CVE-2017-0199, CVE-2023-38831, CVE-2022-0847, CVE-2023-36884, CVE-2026-34486, CVE-2026-39987
Thanks — we review every report.