[CVE-2020-1472] Zerologon Exploit Explained

Takeaways from Zerologon (CVE-2020-1472): the Netlogon flaw let unauthenticated attackers reset a domain controller's password and seize domain admin rights—CVSS 10, exploits circulating—plus CISA's patch order and Microsoft's two-phase fix.

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.

CVE-2026-41089: a stack-based buffer overflow in Windows Netlogon's CLDAP DC locator response can crash LSASS and force domain controller reboots, depending on DNS naming length.

LDAPNightmare, a SafeBreach Labs proof of concept for CVE-2024-49113, coaxes a Windows host, including a domain controller, into crashing via crafted LDAP responses from an attacker-controlled server.

CVE-2026-28326 is an unauthenticated RCE in SolarWinds ARM where a hardcoded shared secret on TCP 55555 leads to SYSTEM-level code execution. Patch now.

A Google Project Zero blog post examining a Windows privilege escalation technique involving dangling COM object registrations, which Microsoft addressed in a recent security update.