{"uuid": "f43e4619-948a-455a-92b2-a85178c1fb4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-1472", "type": "seen", "source": "https://t.me/cissp/1489", "content": "Microsoft Warns of Continued Exploitation of CVE-2020-1472\n\nMicrosoft has released a blog post on cyber threat actors exploiting CVE-2020-1472, an elevation of privilege vulnerability in Microsoft\u2019s Netlogon. A remote attacker can exploit this vulnerability to breach unpatched Active Directory domain controllers and obtain domain administrator access. The Cybersecurity and Infrastructure Security Agency (CISA) has observed nation state activity exploiting this vulnerability. This malicious activity has often, but not exclusively, been directed at federal and state, local, tribal, and territorial (SLTT) government networks.\nCISA urges administrators to patch all domain controllers immediately\u2014until every domain controller is updated, the entire infrastructure remains vulnerable, as threat actors can identify and exploit a vulnerable system in minutes. CISA has released a patch validation script to detect unpatched Microsoft domain controllers. If there is an observation of CVE-2020-1472 Netlogon activity or other indications of valid credential abuse detected, it should be assumed that malicious cyber actors have compromised all identity services.\nIn the coming weeks and months, administrators should take follow-on actions that are described in guidance released by Microsoft to prepare for the second half of Microsoft\u2019s Netlogon migration process, which is scheduled to conclude in February 2021.\n\n \u2022 Microsoft blog post: Attacks exploiting Netlogon vulnerability (CVE-2020-1472)\n \u2022 Microsoft: August Security Advisory for CVE-2020-1472\n \u2022 Microsoft: How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472\n \u2022 CISA Patch Validation Script\n \u2022 Advisory: AA20-283A APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations", "creation_timestamp": "2026-09-02T01:05:01.915098Z"}