KB4565351: Windows Server 2016 / 2019 / 2022 Security Update (May 2026)
An attacker on your network can take over any Domain Controller in seconds by exploiting a flaw in the Netlogon authentication handshake — no credentials required.
An attacker with network access to a Domain Controller's Netlogon service (TCP 445) can reset the DC computer account password to a known value without any credentials. This gives them SYSTEM-level access to the Domain Controller and effectively full control of the Active Directory domain, including all user accounts, group policies, and domain-joined systems.
The Netlogon Remote Protocol uses AES-CFB8 to authenticate computers and domain controllers. A flaw in the implementation allows an attacker to forge a valid Netlogon credential by sending 256 authentication attempts — each using all-zero bytes as the client challenge. Statistically, one of these attempts will succeed with a valid all-zero session key, allowing the attacker to completely change the Domain Controller computer account password.
Probably yes if any of these apply:
Affected OS versions
Zerologon was weaponised in ransomware attacks within weeks of disclosure in September 2020. Ransomware operators used it as a privilege escalation step after gaining initial access to a network — within seconds they had Domain Admin credentials and began deploying ransomware domain-wide.
Manual download
For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.
↗ Microsoft Update CatalogKB4565351Manual remediation steps
⏱ 30–60 minutes including rebootApply the Microsoft Security Update
Microsoft has released an official security update that fixes this vulnerability.
Required KB Updates
Supersedes: KB4565483, KB4598229, KB4598230, KB4598242, KB4598243, KB4598278, KB4598279, KB4598285
Affected Products
Installation Methods
Windows Update (recommended)
Microsoft Update Catalog (manual download)
.msu installer with administrator privilegesWSUS / SCCM / Intune
Approve KB4565351 for the affected products in your update management console.
Microsoft Download Center Links
Verification
Confirm the update is installed:
Get-HotFix | Where-Object { $_.HotFixID -in @('KB4565351','KB4601315','KB4601318','KB4601319','KB4601345','KB4601347','KB4601348','KB4601349','KB4601357','KB4601363','KB4601384') }
References
Discovery Credit
Tom Tervoort of Secura, Zhiniang Peng (@edwardzpeng) & Xuefeng Li (@lxf02942370)
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.