KB5044293: Windows Server 2016 Security Update (October 2024)

An attacker who has any low-privilege domain credential and can reach a domain controller on an adjacent network can predict the name format used for new DCs (e.g. when a DC is being promoted), claim that name, and pose as the new DC. Other DCs in the forest then establish trust with the attacker, allowing them to escalate to domain administrator-equivalent access.

Netlogon is the Windows service that handles authentication between domain members and domain controllers. A flaw in the Netlogon Remote Protocol (MS-NRPC) lets an attacker with valid low-privilege credentials predict and impersonate the name of a newly-promoted domain controller, allowing them to receive trusts and credentials intended for that DC.

Probably yes if any of these apply:

An attacker has phished a single low-privilege domain user. They time their attack to coincide with a planned DC promotion — perhaps timed by social engineering or by observing AD events from their initial foothold. They impersonate the new DC's name, receive replication and trust traffic intended for it, and within hours have domain-admin-level access to the entire forest. Netlogon EoPs in the Zerologon lineage continue to be high-impact whenever they are found.