Zerologon, CVE-2020-1472, was a critical flaw in the Microsoft Netlogon Remote Protocol. CISA says an unauthenticated attacker with network access to a domain controller could exploit it to compromise all Active Directory identity services. CISA issued Emergency Directive 20-04, which applies to federal agencies, and urged everyone else to patch as soon as possible.
What CISA's page says
CISA's current activity note announces ED 20-04 for executive branch departments and agencies. It states that exploit code was released publicly in September 2020 and that, given the exploit and documented adversary behaviour, CISA assumes active exploitation is occurring in the wild. It recommends state and local governments, the private sector and others patch as soon as possible, and links Microsoft's guidance on managing changes to Netlogon secure channel connections.
The page does not list the directive's detailed requirements or deadline, so read the directive itself if you need them.
Why this one got an emergency directive
Emergency directives are rare. This one was issued because of the combination of three facts.
- Impact. A domain controller holds the keys to identity. Compromise of it is compromise of nearly everything that trusts it.
- Access needed. An unauthenticated attacker only needed network access to a domain controller.
- Exploit availability. Public exploit code meant skilled and unskilled attackers alike could use it.
What it teaches about priorities
- Impact beats score alone. A score tells you severity in the abstract. Ask what the affected system controls.
- Public exploit code shortens your time. Once a working exploit is public, assume use and move to the fast queue.
- Domain controllers need their own patch track. They are among the most valuable systems and deserve a short, tested emergency path.
- Network reachability is a control. Limit which hosts can talk to domain controllers. That reduces who can attempt this class of attack.
- Changes can break things. Microsoft's guidance on secure channel changes exists because enforcement can affect legacy devices. Test and inventory first.
Why identity systems deserve a faster lane
Most patch programs rank by severity score and by whether a system faces the internet. A domain controller is usually not internet facing, so a simple rule can leave it near the bottom of the queue. The Zerologon case shows why that rule is not enough. An attacker who has any foothold on the internal network can try to reach it, and what sits behind it is the identity of the whole organisation.
Add a column to your asset list for blast radius: what does an attacker gain if this one system falls? Identity providers, directory servers, certificate authorities and build systems score high on that column. Give them a shorter patch target than other internal servers.
A short response checklist
- List domain controllers and confirm their patch level.
- Apply the vendor update and follow the vendor guidance for staged enforcement.
- Review which hosts can reach domain controllers and tighten rules.
- Watch for unusual authentication events and unexpected computer account changes.
- Record the date you applied the fix, for audit trail purposes.
Safeguard's compliance and evidence automation can help record patch timelines for later review. See also the existing post on how to detect Zerologon attacks.
Quick check
Who must follow Emergency Directive 20-04?
It applies to US executive branch departments and agencies. CISA recommends others patch as soon as possible.
Why did CISA assume exploitation?
Exploit code was public in September 2020, and CISA cites documented adversary behaviour.
Sources
Last reviewed: 19 October 2026.
