Which products and versions are affected by CVE-2020-1472?

Affected: samba (arch); rootio-samba; openchange (alma), among others. The full list is in the CVE brief.

Is CVE-2020-1472 being exploited in the wild?

It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Sep 24, 2020 and is known to be used in ransomware campaigns.

Is CVE-2020-1472 in the CISA KEV catalog?

Yes. It was added on Nov 3, 2021 with a federal remediation due date of May 3, 2022.

Is there a public exploit for CVE-2020-1472?

Public exploit code is available.

Is there a fix for CVE-2020-1472?

Fixed versions are available, including ctdb 4.10.16-9.56.amzn1, ctdb 4.10.16-9.amzn2.0.1, ctdb 4.10.16-9.el7_9.

How urgently should CVE-2020-1472 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2020-1472

CriticalExploitedPublic exploit

samba - security update

Published Apr 21, 2021 · Updated Aug 5, 2026 · Also known as ALPINE-CVE-2020-1472, DEBIAN-CVE-2020-1472, SUSE-SU-2020:2719-1, SUSE-SU-2020:2720-1, SUSE-SU-2020:2721-1, SUSE-SU-2020:2722-1, SUSE-SU-2020:2724-1, SUSE-SU-2020:2730-1, TR-21-0130, UBUNTU-CVE-2020-1472, USN-4510-1, USN-4510-2, USN-4559-1, Zero Logon, Zerologon

Key Facts

Patch immediately

CVE-2020-1472 is a critical-severity vulnerability (CVSS 10.0 v3.1) affecting samba (arch), rootio-samba, openchange (alma) and 22 more products.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Sep 24, 2020 and is known to be used in ransomware campaigns. Public exploit code is available.
EPSS estimates a 99% probability of exploitation in the next 30 days.
Fixed versions are available, including ctdb 4.10.16-9.56.amzn1, ctdb 4.10.16-9.amzn2.0.1, ctdb 4.10.16-9.el7_9.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

10.0

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

99%

Higher than 99.9% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings, used by ransomware

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2020-1472 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
CISA KEV	Nov 3, 2021	May 3, 2022	Known
Industry KEV feed	Sep 24, 2020	May 3, 2022	Known
CIRCL KEV	Nov 3, 2021	May 3, 2022	Known
ENISA EUVD	Nov 3, 2021	n/a	Not reported

Required action: Apply updates per vendor instructions.

Affected Products

1,666 affected entries in total

Product	Affected versions	Fixed in
sambaarch	See advisory	4.13.0-1
rootio-sambarootio	See advisory	4.12.7-r0
openchangealma	See advisory	2.3-27.el8
ctdbamazon	See advisory	4.10.16-9.56.amzn1
ctdb-testsamazon	See advisory	4.10.16-9.56.amzn1

20 more affected products in the full CVE brief

Patched Releases

ctdb

4.10.16-9.56.amzn1, 4.10.16-9.amzn2.0.1, 4.10.16-9.el7_9, 4.10.18+git.208.88201368c52-3.17.1, 4.11.13+git.189.e9bd318cd13-4.11.1, 4.11.13+git.189.e9bd318cd13-lp152.3.13.1, 4.13.3-3.el8, 4.14.6+git.182.2205d5224e3-1.1, 4.4.2-38.36.1, 4.6.16+git.237.40a3f495f75-3.55.1, 4.7.11+git.270.63e2076625b-4.48.1, 4.9.5+git.373.26895a83dbf-3.44.1, 4.9.5+git.373.26895a83dbf-lp151.2.33.1

ctdb-pcp-pmda

4.11.13+git.189.e9bd318cd13-lp152.3.13.1, 4.14.6+git.182.2205d5224e3-1.1, 4.9.5+git.373.26895a83dbf-lp151.2.33.1

ctdb-tests

4.10.16-9.56.amzn1, 4.10.16-9.amzn2.0.1, 4.10.16-9.el7_9, 4.11.13+git.189.e9bd318cd13-lp152.3.13.1, 4.13.3-3.el8, 4.9.5+git.373.26895a83dbf-lp151.2.33.1

libdcerpc-binding0

4.10.18+git.208.88201368c52-3.17.1, 4.11.13+git.189.e9bd318cd13-4.11.1, 4.11.13+git.189.e9bd318cd13-lp152.3.13.1, 4.14.6+git.182.2205d5224e3-1.1, 4.4.2-38.36.1, 4.6.16+git.237.40a3f495f75-3.55.1, 4.7.11+git.270.63e2076625b-4.48.1, 4.9.5+git.373.26895a83dbf-3.44.1, 4.9.5+git.373.26895a83dbf-lp151.2.33.1

libdcerpc-binding0-32bit

libdcerpc-devel

4.11.13+git.189.e9bd318cd13-4.11.1, 4.11.13+git.189.e9bd318cd13-lp152.3.13.1, 4.14.6+git.182.2205d5224e3-1.1, 4.7.11+git.270.63e2076625b-4.48.1, 4.9.5+git.373.26895a83dbf-3.44.1, 4.9.5+git.373.26895a83dbf-lp151.2.33.1

libdcerpc-samr-devel

libdcerpc-samr0

libdcerpc-samr0-32bit

4.11.13+git.189.e9bd318cd13-lp152.3.13.1, 4.14.6+git.182.2205d5224e3-1.1, 4.9.5+git.373.26895a83dbf-lp151.2.33.1

libdcerpc0

libdcerpc0-32bit

libndr-devel

4.10.18+git.208.88201368c52-3.17.1, 4.11.13+git.189.e9bd318cd13-4.11.1, 4.11.13+git.189.e9bd318cd13-lp152.3.13.1, 4.14.6+git.182.2205d5224e3-1.1, 4.7.11+git.270.63e2076625b-4.48.1, 4.9.5+git.373.26895a83dbf-3.44.1, 4.9.5+git.373.26895a83dbf-lp151.2.33.1

libndr-krb5pac-devel

libndr-krb5pac0

libndr-krb5pac0-32bit

libndr-nbt-devel

libndr-nbt0

libndr-nbt0-32bit

libndr-standard-devel

libndr-standard0

libndr-standard0-32bit

libndr0

4.10.18+git.208.88201368c52-3.17.1, 4.11.13+git.189.e9bd318cd13-4.11.1, 4.11.13+git.189.e9bd318cd13-lp152.3.13.1, 4.4.2-38.36.1, 4.6.16+git.237.40a3f495f75-3.55.1, 4.7.11+git.270.63e2076625b-4.48.1, 4.9.5+git.373.26895a83dbf-3.44.1, 4.9.5+git.373.26895a83dbf-lp151.2.33.1

libndr0-32bit

libndr1

4.14.6+git.182.2205d5224e3-1.1

libndr1-32bit

4.14.6+git.182.2205d5224e3-1.1

Timeline

Added to Industry KEV feed
Sep 24, 2020
Publicly disclosed
Apr 21, 2021
Added to CISA KEV
Nov 3, 2021
Added to CIRCL KEV
Nov 3, 2021
Added to ENISA EUVD
Nov 3, 2021
Last updated
Aug 5, 2026

Weakness Type

CWE-287 Improper Authentication

References

advisoryopenSUSE-SU-2020:1513
advisoryopenSUSE-SU-2020:1526
advisoryhttp://packetstormsecurity.com/files/159190/Zerologon-Proof-Of-Concept.html
advisoryRHBA-2021:1503
advisoryRHSA-2020:5439

15 more references in the full CVE brief

FAQ

Common Questions.

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC).
Affected: samba (arch); rootio-samba; openchange (alma), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Sep 24, 2020 and is known to be used in ransomware campaigns.
Yes. It was added on Nov 3, 2021 with a federal remediation due date of May 3, 2022.
Public exploit code is available.
Fixed versions are available, including ctdb 4.10.16-9.56.amzn1, ctdb 4.10.16-9.amzn2.0.1, ctdb 4.10.16-9.el7_9.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2020-1472 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.