Security Experts:

Connect with us

Hi, what are you looking for?


Incident Response

Microsoft Reminds Organizations of Upcoming Phase in Patching Zerologon Vulnerability

Microsoft this week published a reminder for organizations that a February 9 security update will kick off the second phase of patching for the Zerologon vulnerability.

Microsoft this week published a reminder for organizations that a February 9 security update will kick off the second phase of patching for the Zerologon vulnerability.

Tracked as CVE-2020-1472 and addressed on August 2020 Patch Tuesday, the critical vulnerability was identified in the Microsoft Windows Netlogon Remote Protocol (MS-NRPC) and can be abused to compromise Active Directory domain controllers and gain admin access.

Exploitable by unauthenticated attackers able to run a specially crafted application on a device on the network, the vulnerability came into the spotlight in September, after the Department of Homeland Security (DHS) told federal agencies to immediately apply patches for it.

Attacks targeting the vulnerability were observed soon after, and Microsoft issued guidance on how organizations can secure systems affected by the bug. Attacks targeting Zerologon, however, continued.

Microsoft told customers that the patching for this vulnerability would be performed in two stages: the deployment of the August 11 patches, and an enforcement phase set to start on February 9, 2021.

Now, the company reminds organizations of the upcoming transition into the enforcement stage, which will kick off on February 2021 Patch Tuesday.

“We are reminding our customers that beginning with the February 9, 2021 Security Update release we will be enabling Domain Controller enforcement mode by default. This will block vulnerable connections from non-compliant devices,” Microsoft notes.

With the DC enforcement mode enabled, all Windows and non-Windows devices will have to use secure RPC with Netlogon secure channel. However, customers will have the option to add exceptions for non-compliant devices, even if that would render their accounts vulnerable.

In preparation for the enforcement mode phase, organizations should apply the available patch to all domain controllers and should identify and resolve non-compliant devices to ensure they won’t make vulnerable connections.

They can also enable the Domain Controller enforcement mode in their environments prior to the February 9 update.

In a report covering the 2020 threat landscape, Tenable considers Zerologon the top vulnerability of last year, out of 18,358 reported CVEs.

Related: QNAP Issues Advisory on Zerologon Vulnerability

Related: Zerologon Chained With Fortinet, MobileIron Vulnerabilities in U.S. Government Attacks

Related: Microsoft Says Iranian Hackers Exploiting Zerologon Vulnerability

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Management & Strategy

SecurityWeek examines how a layoff-induced influx of experienced professionals into the job seeker market is affecting or might affect, the skills gap and recruitment...


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...

Application Security

GitHub this week announced the revocation of three certificates used for the GitHub Desktop and Atom applications.

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...