Onelogon Vulnerability Circumvents Microsoft’s Zerologon Security Patch

Brief Overview

• A newly found Onelogon exploit circumvents Microsoft’s Zerologon security update.
• This vulnerability impacts Microsoft’s Active Directory, enabling attackers to take control of domains.
• Onelogon employs a 24-bit brute force attack, securing access in an average of 32 minutes.
• An alternative attack method necessitates no initial account access and can succeed in around 37 minutes.
• Microsoft recommends the use of secure RPCs to guard against these vulnerabilities, although not all organizations can enforce them.
• Research indicates a considerable number of systems still remain susceptible to these exploits.

The Onelogon Exploit

German security experts Alexander Neff, Tobias Holl, and Kevin Borgolte from Ruhr University have uncovered a new vulnerability termed Onelogon. This exploit is reminiscent of the notorious Zerologon from 2020, which enabled attackers to fully breach Active Directory management domains.

Mechanism of Onelogon

The researchers have devised a 24-bit brute force attack that necessitates a compromised, low-privilege computer account. This strategy can reset a server-side challenge cache and achieve access in about 32 minutes on average. Moreover, a meet-in-the-middle attack, which does not require previous account access, can breach a domain controller in roughly 37 minutes.

Microsoft’s Reaction

In spite of the seriousness, Microsoft has not intended to directly rectify the Onelogon problem. The company suggests employing secure Remote Procedure Calls (RPCs) to alleviate the threat posed by both Onelogon and Zerologon vulnerabilities. Nevertheless, not all organizations can utilize secure RPCs, leaving numerous systems vulnerable.

Current Vulnerability Status

Recent studies reveal a concerning number of organizations continue to be at risk. A 2025 audit uncovered that nearly a quarter of 44 Active Directory environments permitted vulnerable Netlogon secure channel connections. A 2026 examination across 270 organizations identified six systems directly at risk from Onelogon.

Technical Insights

The Netlogon protocol from Microsoft, which is part of Active Directory, authenticates a computer’s identity by scrambling a code using a confidential key. Regrettably, the scrambling begins from a fixed, predictable starting point, which attackers can take advantage of. This predictability allows them to eventually circumvent security checks without needing to know the secret key.

Patching Limitations

The update Microsoft released for Zerologon only verifies if the first five bytes of a challenge are the same. It overlooks other patterns that generate predictable ciphertext, making the patch incomplete and evadable. A comprehensive fix would need to break backward compatibility to properly implement the cryptographic protocol.

Conclusion

The Onelogon vulnerability underscores persistent security issues with Microsoft’s Active Directory, especially the shortcomings in the Zerologon patch. While secure RPCs could provide a solution, their application is not widespread, leaving many systems vulnerable. Organizations need to remain alert and consider alternative security strategies to safeguard their networks.