Neff

www.usenix.org • August 13, 2026

Microsoft's Active Directory (AD) is a critical component of the IT infrastructure of numerous enterprises. Thus, security vulnerabilities in AD can have dire consequences for the security posture of an organization's IT infrastructure. At the core of the AD architecture is the Netlogon Remote Protocol, which is used to manage computer accounts, delegate authentication requests, and various other management tasks.

In 2020, Tervoort identified Zerologon, a critical vulnerability in Netlogon, which allowed attackers to fully compromise an AD management domain. In turn, Microsoft released two patches: one aiming to rectify the cryptographic vulnerability that enabled the attack, and the second one to ensure that all Netlogon communication is signed and sealed.

In this paper, we analyze these patches and show that they are insufficient to mitigate the underlying vulnerabilities. We show that the cryptographic patch can be bypassed by an unprivileged attacker within the AD domain. We introduce the Onelogon attack with two distinct variants for varying attacker capabilities, both of which allow an attacker to take over a vulnerable AD account in approximately 30 minutes. If this AD account belongs to a Domain Controller, an attacker can leverage Onelogon to fully compromise the AD domain.

With the goal of mitigating the attacks, we identified their underlying root cause: the incorrect use of AES-CFB8 encryption. Both the earlier Zerologon attack and our new attack exploit how Netlogon incorrectly uses AES-CFB8. Finally, we provide and compare various mitigation and detection approaches for Microsoft and AD operators to prevent account takeover attacks and authentication bypasses in the short term and fundamentally. Unfortunately, addressing the underlying root cause requires a backward-incompatible change to Netlogon: reimplementing AES-CFB8 correctly.

We disclosed this issue to Microsoft and CERT-Bund, but do not expect any fixes to be forthcoming. In the meantime, we advise users to apply the mitigation and detection strategies outlined in this paper.

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Onelogon Attack Exploits Microsoft Zerologon Patch Flaw German researchers have discovered a new vulnerability named Onelogon, which exploits the previously patched Zerologon flaw (CVE-2020-1472) in Microsoft's Active Directory. The Onelogon attack can be executed using two methods: a 24-bit brute force attack requiring a low-privilege account, and a meet-in-the-middle attack that does not require prior access. Both methods can compromise an Active Directory account in approximately 30-37 minutes. Despite Microsoft releasing patches for Zerologon, the researchers found that the cryptographic implementation remains flawed, allowing the Onelogon attack to succeed. The vulnerability primarily affects organizations that have not implemented secure Remote Procedure Calls (RPCs), with scans revealing that many still allow vulnerable configurations. The researchers disclosed their findings to Microsoft but do not expect any fixes soon, advising users to adopt mitigation strategies instead. 2 sources 68

Extracted Entities

Vulnerabilities (1)

Zerologon