CVE-2020-1472 — Microsoft Windows Server 1903

What is CVE-2020-1472?

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

The record classifies CVE-2020-1472 under weakness class NVD-CWE-noinfo. Its CVSS v3 base vector states that the flaw requires local access to the host, needs low-privilege credentials, needs no user interaction, and has high impact on confidentiality. 23 affected-product entries are recorded, across 8 vendors, listed below. The identifier was first published 2263 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 5.5 — MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS (FIRST): 99.3% probability of exploitation in the next 30 days, higher than 99.9% of all scored CVEs
CISA KEV: Listed since 2021-11-03, federal remediation deadline 2022-05-03 — used in known ransomware campaigns
Threadlinqs priority: 10/10 — CISA lists it as used in ransomware, which Threadlinqs scores at the maximum
Published: 2020-08-17, last modified 2025-10-21

Is CVE-2020-1472 being exploited?

CISA added CVE-2020-1472 to the Known Exploited Vulnerabilities catalog on 2021-11-03, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2022-05-03 under BOD 22-01. CISA flags the vulnerability as one used in known ransomware campaigns. Weaponised exploit code for CVE-2020-1472 is publicly available. 11 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 58 in the Threadlinqs vulnerability feed.

Affected products and versions

Microsoft: Windows Server 1903, Windows Server 1909, Windows Server 2004, Windows Server 2008 r2, Windows Server 2012, Windows Server 2012 r2, Windows Server 2016, Windows Server 2019, Windows Server 20h2
Fedoraproject: Fedora 31, Fedora 32, Fedora 33
Opensuse: Leap 15.1, Leap 15.2
Canonical: Ubuntu Linux 14.04, Ubuntu Linux 16.04, Ubuntu Linux 18.04, Ubuntu Linux 20.04
Synology: Directory Server
Samba: Samba
Debian: Linux 9.0
Oracle: Zfs Storage Appliance Kit 8.8

Showing 22 of 23 recorded product entries.

How to fix CVE-2020-1472

The record marks a vendor fix as available for CVE-2020-1472. Patch reference: https://www.oracle.com/security-alerts/cpuApr2021.html. Vendor advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472. Because CVE-2020-1472 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2022-05-03. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.

Threat activity tracking CVE-2020-1472

12 tracked threats in the Threadlinqs corpus reference CVE-2020-1472, either in the campaign’s CVE list or as an indicator on the campaign record.

Operation Escaneo: MexicanMafia (PanchoVilla) Intrusion Campaign Against Mexican Government Agencies and Latin American Financial Institutions — HIGH · 2026-10-23
INC and The Gentlemen Ransomware: Exposed AI-Executed, Human-Approved Attack Infrastructure (Phantom framework) — CRITICAL · 2026-10-20
Ransomware Incidents Surge 4.7% in Japan H1 2026: The Gentlemen and Qilin Lead, AI-Assisted Tooling Observed — HIGH · 2026-09-17
Rhysida Ransomware Campaign Targeting German Public Administration (Stuttgart and Berlin, 2026) — CRITICAL · 2026-09-06
Rhysida Ransomware Claims Berlin State Government Breach Ahead of September Election — HIGH · 2026-08-29
LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp) — HIGH · 2026-08-21
La Trobe University research: network-based detection of SMB shared-storage ransomware encryption — INFO · 2026-07-05
Capita Black Basta Ransomware Incident (March 2023) — Record £14M UK ICO Fine for 6M+ Affected Individuals — HIGH · 2026-06-10
Kyber Ransomware: Post-Quantum Hybrid Encryption Operation Targeting Windows & VMware ESXi — CRITICAL · 2026-04-22
MuddyWater Operation Olalampo — Iran MOIS-Nexus APT Deploys New Malware Variants with Telegram Bot C2 Targeting Middle Eastern Governments and Critical Infrastructure — HIGH · 2026-02-28
Black Basta Ransomware: Internal Chat Leaks Expose $100M+ RaaS Operation — Conti Successor Unmasked — HIGH · 2026-02-12
Static Tundra (Dragonfly/Energetic Bear) ICS Attacks on Polish Energy Infrastructure — CRITICAL · 2026-02-02

Sources

Enriched from CVE.org, FIRST EPSS, CISA KEV, public proof-of-concept repositories. Last verified by Threadlinqs on 2026-10-10.

CVE-2020-1472 — Microsoft Windows Server 1903

What is CVE-2020-1472?

Severity and exploitation probability

Is CVE-2020-1472 being exploited?

Affected products and versions

How to fix CVE-2020-1472

Threat activity tracking CVE-2020-1472

Sources

Vendor advisory and patch

Third-party advisory

Mailing list and disclosure

Other references