Microsoft Netlogon Privilege Escalation

What to do

1. Update Windows Server version 2004 to publication or a later version.
2. Update Windows Server 2019 to publication or a later version.
3. Update Windows Server 2019 (Server Core installation) to publication or a later version.
4. CISA's required action: Apply updates per vendor instructions.
5. Read the advisory on portal.msrc.microsoft.com for workarounds and exact fixed builds.
6. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

Version data comes from the organisation that assigned the CVE; 1 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector

NetworkCan be exploited remotely over a network, including the internet.

Attack complexity

LowNo special conditions are needed; the attack works reliably.

Privileges required

NoneNo account or login is needed.

User interaction

NoneNo action by a victim is required.

Scope

ChangedThe attack can reach beyond the vulnerable component into other systems.

Confidentiality

HighAll data handled by the component can be read.

Integrity

HighData or code can be modified at will.

Availability

HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Scored by NVD.

Official description

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

Timeline

1. August 17, 2020CVE record published.
2. November 3, 2021Added to CISA's Known Exploited Vulnerabilities catalogue.
3. May 3, 2022Deadline for US federal agencies to remediate, set by CISA.
4. January 30, 2024CISA published its SSVC assessment (exploitation: active, automatable: yes, technical impact: total).
5. June 17, 2026Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Windows Server version 2004

• 7.8 High severity

  Microsoft Windows Privilege Escalation Exploited

  CVE-2021-43226Dec 15, 2021MicrosoftEPSS 3.28%
• 8.8 High severity

  Microsoft Active Directory Domain Services Privilege Escalation Exploited

  CVE-2021-42287Nov 10, 2021MicrosoftEPSS 77.2%
• 7.5 High severity

  Microsoft Active Directory Domain Services Privilege Escalation Exploited

  CVE-2021-42278Nov 10, 2021MicrosoftEPSS 73.3%
• 7.8 High severity

  Microsoft Windows Installer Privilege Escalation Exploited

  CVE-2021-41379Nov 10, 2021MicrosoftEPSS 19.5%
• 7.8 High severity

  Microsoft Win32k Privilege Escalation Exploited

  CVE-2021-41357Oct 13, 2021MicrosoftEPSS 1.52%
• 7.8 High severity

  Microsoft Win32k Privilege Escalation Exploited

  CVE-2021-40450Oct 13, 2021MicrosoftEPSS 1.52%

Spotted an error? Tell us.