CISA Releases Emergency Directive on Microsoft Windows Netlogon Remote Protocol (Zerologon)

The Cybersecurity and Infrastructure Security Agency (CISA) has released Emergency Directive (ED) 20-04 addressing a critical vulnerability— CVE-2020-1472—affecting Microsoft Windows Netlogon Remote Protocol. An unauthenticated attacker with network access to a domain controller could exploit this vulnerability to compromise all Active Directory identity services.

Earlier this month, exploit code for this vulnerability was publicly released. Given the nature of the exploit and documented adversary behavior, CISA assumes active exploitation of this vulnerability is occurring in the wild.

ED 20-04 applies to Executive Branch departments and agencies; however, CISA strongly recommends state and local governments, the private sector, and others patch this critical vulnerability as soon as possible.

ED 20-04 requires Federal Agencies to update all Windows Servers with the domain controller role by 11:59pm EDT, Monday September 21, 2020 by applying the August 2020 Security Updates provided by Microsoft.

ED-20-04 can be found here: https://cyber.dhs.gov/ed/20-04/

Microsoft’s Security Bulletin on CVE-2020-1472 (Zerologon) which includes patching information can be found here: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472