The US Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has published an emergency directive requiring federal agencies to mitigate a critical vulnerability in the Microsoft Windows Netlogon Remote Protocol (MS-NRPC), a core authentication component of Active Directory.
“CISA has determined that this vulnerability poses an unacceptable risk to the Federal Civilian Executive Branch and requires an immediate and emergency action,” officials state. The agency last week issued an alert for the flaw following the discovery of publicly available exploit code.
CVE-2020-1472, also called “Zerologon,” has a CVSS score of 10 and is categorized as Critical by Microsoft. It exists when an attacker creates a vulnerable…