{"id":"CVE-2020-1472","published":"2020-08-17T19:15:15Z","modified":"2026-06-17T03:01:29Z","title":"Microsoft Netlogon Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Netlogon","tier":"core","eol":null,"description":{"text":"An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.\nTo exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.\nMicrosoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.\nFor guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see  How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020).\nWhen the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.","provenance":"source","from":"NVD"},"summary":null,"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.99389,"percentile":0.9994,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 20-04 (https://www.cisa.gov/news-events/directives/ed-20-04-mitigate-netlogon-elevation-privilege-vulnerability-august-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-04. https://nvd.nist.gov/vuln/detail/CVE-2020-1472","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-09-24","exploitedFirstSeen":"2020-09-24","ransomware":true,"evidence":[{"url":"https://cisa.gov/news-events/alerts/2020/09/24/unpatched-domain-controllers-remain-vulnerable-netlogon-vulnerability","date":"2020-09-24"},{"url":"https://threatpost.com/microsoft-zerologon-attack-iranian-actors/159874/","date":"2020-10-06"},{"url":"https://www.darkreading.com/threat-intelligence/critical-zerologon-flaw-exploited-in-ta505-attacks/d/d-id/1339141","date":"2020-10-09"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-275a","date":"2020-10-20"},{"url":"https://media.cert.europa.eu/static/MEMO/2020/TLP-WHITE-CERT-EU-THREAT-MEMO-Thanos-ransomware.pdf","date":"2020-10-20"},{"url":"https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF","date":"2020-10-20"},{"url":"https://us-cert.cisa.gov/ncas/alerts/aa20-275a","date":"2020-10-20"},{"url":"https://us-cert.cisa.gov/ncas/alerts/aa20-296a","date":"2020-10-22"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-283a","date":"2020-10-24"},{"url":"https://cybersecurity.bd.com/bulletins-and-patches/ryuk-ransomware","date":"2020-10-30"}],"evidenceTotal":152,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"INC and The Gentlemen Ransomware: Exposed AI Infrastructure","url":"https://otx.alienvault.com/pulse/6ae254acfd783d5b63290659","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"INC and The Gentlemen Ransomware: Exposed AI Infrastructure","url":"https://otx.alienvault.com/pulse/6ad8db024c84442cd0085496","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-330","name":"Use of Insufficiently Random Values"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00080.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00086.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/159190/Zerologon-Proof-Of-Concept.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/160127/Zerologon-Netlogon-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2020/09/17/2","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/","tags":["Mailing List","Third Party Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472","tags":["Patch","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/202012-24","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4510-1/","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4510-2/","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4559-1/","tags":["Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/490028","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.synology.com/security/advisory/Synology_SA_20_21","tags":["Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00080.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00086.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/159190/Zerologon-Proof-Of-Concept.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/160127/Zerologon-Netlogon-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2020/09/17/2","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/","tags":["Mailing List","Third Party Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472","tags":["Patch","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/202012-24","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4510-1/","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4510-2/","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4559-1/","tags":["Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/490028","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.synology.com/security/advisory/Synology_SA_20_21","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1472","tags":["US Government Resource"]}],"techniques":[{"id":"T1110","name":"Brute Force","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2020-1472 is a privilege elevation vulnerability. The immediate effect of successful exploitation results in the ability to authentication to the vulnerable Domain Controller with Domain Administrator level credentials. In compromises exploiting this vulnerability, exploitation was typically followed immediately by dumping all hashes for Domain accounts.","confidence":"high"},{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2020-1472 is a privilege escalation vulnerability in Windows Netlogon. After gaining initial access, the actors exploit CVE-2020-1472 to compromise all Active Directory (AD) identity services. Actors have then been observed using legitimate remote access tools, such as VPN and Remote Desktop Protocol (RDP), to access the environment with the compromised credentials.","confidence":"high"},{"id":"T1021","name":"Remote Services","tactics":["lateral-movement"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"primary_impact","evidence":[],"comment":"CVE-2020-1472 is a privilege elevation vulnerability. The immediate effect of successful exploitation results in the ability to authentication to the vulnerable Domain Controller with Domain Administrator level credentials. In compromises exploiting this vulnerability, exploitation was typically followed immediately by dumping all hashes for Domain accounts.","confidence":"high"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"primary_impact","evidence":[],"comment":"CVE-2020-1472, an elevation of privilege vulnerability in Microsoft’s Netlogon. A remote attacker can exploit this vulnerability to breach unpatched Active Directory domain controllers and obtain domain administrator access. ","confidence":"high"},{"id":"T1087.002","name":"Domain Account","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"primary_impact","evidence":[],"comment":"CVE-2020-1472 is a privilege elevation vulnerability. The immediate effect of successful exploitation results in the ability to authentication to the vulnerable Domain Controller with Domain Administrator level credentials. In compromises exploiting this vulnerability, exploitation was typically followed immediately by dumping all hashes for Domain accounts.","confidence":"high"},{"id":"T1486","name":"Data Encrypted for Impact","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2020-1472, an elevation of privilege vulnerability in Microsoft’s Netlogon. A remote attacker can exploit this vulnerability to breach unpatched Active Directory domain controllers and obtain domain administrator access. CVE-2020-1472 has been reported to be exploited by Ransomware groups for initial access.  ","confidence":"high"}],"reports":[{"id":"SRC-622b5f77d51256e536ea","title":"Cadet Blizzard emerges as a novel and distinct Russian threat actor","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/","date":"2023-06-14","mentions":[{"quote":"keyboard attack via Impacket toolkit\n- Suspicious PowerShell command line\n- Suspicious WMI process creation\nMicrosoft Defender Vulnerability Management\nMicrosoft Defender Vulnerability Management surfaces devices that may be affected by the following vulnerabilities used in this threat:\n- CVE-2021-26084\n- CVE-2020-1472","start":20932,"end":21252}]},{"id":"SRC-cb049733b1fc717427aa","title":"Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure","publisher":"cisa.gov","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf","date":null,"mentions":[{"quote":" CVE-2020-1472 (Microsoft: Windows Server)","start":9720,"end":9763},{"quote":" NIST NVD: CVE-2020-1472","start":36854,"end":36879}]},{"id":"SRC-c394fa88286c8c1f33ff","title":"Secure Cloud Analytics Alerts and Observations Reference Guide","publisher":"cisco.com","url":"https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/cloud/reference/Alerts_and_Observations_DV_4_13.pdf","date":null,"mentions":[{"quote":"FollowmitigationstepsinreferencetoCVE-2020-1472.","start":162702,"end":162750}]},{"id":"SRC-931aa86cc546bf419e35","title":"Malicious ISO File Leads to Domain Wide Ransomware","publisher":"thedfirreport.com","url":"https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/","date":null,"mentions":[{"quote":"The threat actor then proceeded to exploit CVE-2020-1472, aka ZeroLogon.","start":1996,"end":2068},{"quote":"This traffic then triggered several network signatures for CVE-2020-1472 otherwise known as ZeroLogon.","start":14054,"end":14156},{"quote":"ET EXPLOIT Possible Zerologon Phase 1/3 - NetrServerReqChallenge with 0x00 Client Challenge (CVE-2020-1472)","start":14157,"end":14264},{"quote":"ET EXPLOIT Zerologon Phase 2/3 - NetrServerAuthenticate2 Request with 0x00 Client Challenge and Sign and Seal Disabled (CVE-2020-1472) M1","start":14266,"end":14403},{"quote":"ET HUNTING Suspicious lsass.exe in URI\r\nET MALWARE Win32/IcedID Request Cookie\r\nET POLICY SSL/TLS Certificate Observed (AnyDesk Remote Desktop Software)\r\nET USER_AGENTS AnyDesk Remote Desktop Software User-Agent\r\nET EXPLOIT Possible Zerologon Phase 1/3 - NetrServerReqChallenge with 0x00 Client Challenge (CVE-2020-1472)","start":52959,"end":53279}]},{"id":"SRC-899bdc5937460259da35","title":"Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign","publisher":"security.com","url":"https://www.security.com/threat-intelligence/cicada-apt10-japan-espionage","date":null,"mentions":[{"quote":"The attackers were also seen deploying a tool capable of exploiting the ZeroLogon vulnerability (CVE-2020-1472).","start":6745,"end":6857}]},{"id":"SRC-6befe779eb6a63e5b15c","title":"RansomHub never sleeps episode 1","publisher":"group-ib.com","url":"https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/","date":null,"mentions":[{"quote":"This technique allowed the attacker to exploit two vulnerabilities in the domain controller: CVE-2021-42278 (sAMAccount Spoofing) and CVE-2020-1472.","start":13554,"end":13702},{"quote":"second one, labelled with CVE-2020-1472 and known also as ZeroLogon, affects Microsoft’s Active Directory NetLogon remote Protocol (MS-NRPC), and it allows a malicious actor without user credentials to gain the highest privileges in the domain, and take the control of a vulnerable domain controller via NT Lan","start":14420,"end":14730}]},{"id":"SRC-17ea9c4fbe88efe8ca66","title":"THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control","publisher":"cybereason.com","url":"https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control","date":null,"mentions":[{"quote":"injected Cobalt Strike beacon:\nBumblebee leveraging WMI to run wab.exe and wabmig.exe with injected floating code as seen in the Cybereason Defense Platform\nPrivilege Escalation and Cobalt Strike deployment\nBumblebee performs privilege escalation by loading an exploit for CVE-2020-1472 (Zerologon) into","start":7066,"end":7369}]},{"id":"SRC-17432e25b771560ddaf4","title":"RYUK RANSOMWARE","publisher":"cert.ssi.gouv.fr","url":"https://cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf","date":null,"mentions":[{"quote":"Privileges have been escalated using Mimikatz, Rubeus 4 [13], or by exploiting a Zerologon vulnerability (CVE-2020-\r\n1472) [26].","start":13628,"end":13756}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-12346","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-12346","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":49071,"url":"https://www.exploit-db.com/exploits/49071","title":"ZeroLogon - Netlogon Elevation of Privilege","type":"remote","platform":"windows","date":"2020-11-18","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2020-11-18"},"pocGithub":{"count":59,"skipped":15,"earliest":"2020-09-08","earliestUrl":"https://github.com/bvcyber/CVE-2020-1472","repos":[{"name":"bvcyber/CVE-2020-1472","url":"https://github.com/bvcyber/CVE-2020-1472","stars":1839,"created":"2020-09-08"},{"name":"dirkjanm/CVE-2020-1472","url":"https://github.com/dirkjanm/CVE-2020-1472","stars":1333,"created":"2020-09-14"},{"name":"risksense/zerologon","url":"https://github.com/risksense/zerologon","stars":709,"created":"2020-09-14"},{"name":"VoidSec/CVE-2020-1472","url":"https://github.com/VoidSec/CVE-2020-1472","stars":399,"created":"2020-09-14"},{"name":"bb00/zer0dump","url":"https://github.com/bb00/zer0dump","stars":179,"created":"2020-09-14"}]},"metasploit":[{"name":"Netlogon Weak Cryptographic Authentication","module":"auxiliary/admin/dcerpc/cve_2020_1472_zerologon","type":"auxiliary","disclosureDate":null,"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/dcerpc/cve_2020_1472_zerologon.rb"}],"first":{"date":"2020-09-08","source":"PoC-in-GitHub","url":"https://github.com/bvcyber/CVE-2020-1472"},"provenance":"source"},"detections":{"cveRules":[{"title":"Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC","id":"dcc6a01e-9471-44a0-a699-71ea96f8ed8b","level":"high","status":"test","path":"rules-emerging-threats/2020/Exploits/CVE-2020-1472/proc_creation_win_exploit_cve_2020_1472_zero_poc.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-1472/proc_creation_win_exploit_cve_2020_1472_zero_poc.yml","techniques":["T1210"]},{"title":"Potential Zerologon (CVE-2020-1472) Exploitation","id":"dd7876d8-0f09-11eb-adc1-0242ac120002","level":"high","status":"test","path":"rules-placeholder/windows/builtin/security/win_security_exploit_cve_2020_1472.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-placeholder/windows/builtin/security/win_security_exploit_cve_2020_1472.yml","techniques":["T1068"]}]},"exploitRefs":["http://packetstormsecurity.com/files/160127/Zerologon-Netlogon-Privilege-Escalation.html","http://packetstormsecurity.com/files/159190/Zerologon-Proof-Of-Concept.html"],"flow":[{"stage":"exploitation","techniques":["T1133","T1110"],"provenance":"source"},{"stage":"primary","techniques":["T1068","T1087.002","T1021"],"provenance":"source"},{"stage":"secondary","techniques":["T1486"],"provenance":"source"}],"timeline":[{"date":"2020-08-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1472","provenance":"source"},{"date":"2020-09-08","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2020-11-18","url":"https://github.com/bvcyber/CVE-2020-1472","provenance":"source"},{"date":"2020-09-24","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cisa.gov/news-events/alerts/2020/09/24/unpatched-domain-controllers-remain-vulnerable-netlogon-vulnerability","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-12346","provenance":"source"},{"date":"2023-06-14","kind":"report","label":"Named in microsoft.com: Cadet Blizzard emerges as a novel and distinct Russian threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/","provenance":"machine"}],"speed":{"daysToPublicExploit":22,"firstExploitFrom":"PoC-in-GitHub","daysToKev":443},"priority":{"score":86.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2228 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9994"},{"name":"Named in threat reports","points":10.0,"detail":"8 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 NVD exploit link; 59 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":3.85,"detail":"base score 5.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}