German security researchers have reanimated a well-known authentication bypass bug affecting Microsoft’s Active Directory (AD) that was routinely abused by attackers some years ago, and which the tech giant supposedly patched: Zerologon (CVE-2020-1472).
Researchers Alexander Neff, Tobias Holl and Kevin Borgolte at Bochum’s Ruhr University have dubbed the new vulnerability Onelogon, reminiscent of security researcher Tom Tervoort’s Zerologon from 2020.
Zerologon allows attackers to fully compromise an AD management domain.
Now, the German researchers have devised a 24-bit brute force attack, which needs a compromised, low-privilege computer account to reset a server-side challenge cache and which could gain access in about 32 minutes on average.
A second meet-in-the-middle attack that needs no prior account access sprays authentication attempts at a domain controller on a Windows network and is able to get through in 37 minutes on average.
The saving grace for Onelogon is that it’s a legacy compatibility issue, and not a lack of patching problem as such.
Microsoft won’t fix the issue, as its best practice advice is to always use secure Remote Procedure Calls (RPCs), the researchers said.
Secure RPCs stop the Zerologon and Onelogon vulnerabilities.
Nevertheless, not every organisation can run secure RPC, and the research paper points to two recent scans, including one in late 2025 that found nearly a quarter of 44 AD enterprise environments still having an active group policy to allow vulnerable Netlogon secure channel connections.
A later scan in 2026 of a different set of 270 organisations found six systems with configurations that were directly exploitable by the Onelogon vulnerability.
Microsoft’s Netlogon protocol is part of Active Directory and proves a computer’s identity in a network domain by scrambling a code using a secret key that nobody outside the network is supposed to know.
However, Microsoft wrote the protocol in such a way that the scrambling process always starts from the same, fixed predictable point, hardcoded to all zeroes, which is counter to advice from the United States National Institute of Standards and Technology (NIST) that says such points should be unpredictable.
Due to this, an attacker can exploit the predictability to eventually guess, or force their way past the check, without ever having to learn the actual secret key; this is what Zerologon does, giving attackers a one in 256 chance of forging a domain controller’s account credentials and resetting the password for it.
Microsoft’s cryptographic part of its patch for Zerologon only checks if the first five bytes of a challenge are all identical, and if so, rejects these.
The patch does not, however, catch other structured ones that can still produce predictable ciphertext.
This is what makes Microsoft’s patch incomplete, and bypassable, the researchers showed.
Fixing the problem would require Microsoft to break backwards compatibility and implement the cryptographic protocol correctly.
Western cyber security agencies warned that the Zerologon vulnerability was routinely exploited throughout 2021 as organisations failed to patch for it.
When it was disclosed in 2020, NIST rated the Zerologon vulnerability as 10 out of 10 possible on the common vulnerability scoring system (CVSS), whereas Microsoft felt it was only a 5.5 severity flaw.
The researchers presented their paper at the Workshop on Offensive Technologies (WOOT) conference at USENIX, the advanced computing systems association.
