Is CVE-2020-1472 (Microsoft Netlogon Privilege Escalation) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2020-1472 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller.

What CISA’s KEV Listing Means for This CVE

CISA’s KEV catalogue is the practical signal that this issue is not just theoretical. For defenders, the important question is not whether the weakness exists, but whether Netlogon is exposed on a domain controller or reachable through a path that could allow exploitation before remediation is complete.

That makes this a prioritisation problem as much as a patching problem. If a domain controller is in scope, treat the finding as high urgency, confirm whether compensating controls are actually blocking abuse, and assume the exposure has operational consequences beyond the affected host.

How the Netlogon Vulnerability Creates Real Risk

The weakness sits in a core trust relationship between a client and a domain controller. When that secure channel can be abused, the issue is not limited to one application, it can become a domain-level privilege escalation path with much broader impact than a normal server bug.

That is why the CISA Known Exploited Vulnerabilities Catalog matters here, and why defenders should check the vulnerability against NIST National Vulnerability Database and the CVE Program when validating asset inventory and remediation records.

What to Check, Patch, and Verify After Exposure

Start by identifying every domain controller and every environment that depends on Netlogon-secured communication. If patching or mitigation has already been applied, verify that the control is still in place and that no legacy systems were left behind to preserve compatibility.

If the environment was exposed before remediation, review for signs of domain compromise rather than only host compromise. A flaw in this position can justify credential review, account and trust-path review, and heightened scrutiny of administrative activity around the remediation window.

For the broader playbook, use the Zero-Day and Exploited Vulnerabilities Guide and the Vulnerability Management Guide to structure emergency prioritisation, exception handling, and post-fix verification.

Risk and Threat Considerations

Because this CVE was confirmed as actively exploited and linked by CISA to ransomware use, the main risk is not just unauthorised access, but fast escalation from initial foothold to domain control. In practice, that can turn one weak Netlogon relationship into enterprise-wide compromise if the attacker can reach a domain controller before defenses and remediation are complete.

Failure mechanism: An attacker establishes a vulnerable Netlogon secure channel connection to a domain controller and abuses that trust relationship to escalate privileges.

Impact: The resulting exposure can include domain compromise, lateral movement, loss of administrative trust, and ransomware deployment opportunities across the environment.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1068 — Exploitation for Privilege Escalation	CVE enables privilege escalation through exploitation of a trust flaw.
Recommendation — Map exploitation activity to T1068 and hunt for privilege escalation signals around domain controllers.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities Are Identified and Documented	This page is about validating and responding to an actively exploited vulnerability.
	PR.AA-05 — Access Permissions and Authorizations Are Managed	The flaw abuses a trusted authorization path to a domain controller.
Recommendation — Document affected domain controllers and track exposure until remediation is verified. Tighten and verify authorization paths to domain controllers and remove unnecessary trust.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The core action is urgent remediation of a known exploited flaw.
	IA-5 — Authenticator Management	Exploitation can expose credentials and trust material needing lifecycle review.
Recommendation — Prioritise rapid flaw remediation and verify the fix across all domain controllers. Rotate or reset exposed authenticators and trust material after confirming compromise risk.

Practitioner Guidance

What to prioritise: Treat every domain controller as the highest-value verification target. If you cannot immediately prove that a controller is patched or otherwise protected, assume the issue remains operationally relevant until you can.

What to verify: Confirm that the fix or mitigation was applied everywhere, that no unsupported exceptions remain, and that authentication paths to domain controllers are not being preserved longer than necessary for compatibility.

Practitioner takeaway: This is a case where confirmed exploitation changes the response model, you are not just closing a vulnerability, you are validating whether the domain trust layer was already used as an entry point.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org