Zerologon
A cryptographic flaw in Netlogon that let anyone with network access to a domain controller take over the whole domain in about three seconds. CVE-2020-1472, scored 10 out of 10.
Tom Tervoort at Secura found that Microsoft's own variant of AES in CFB8 mode was being used with an initialisation vector of all zeros. In that combination roughly one key in 256 produces ciphertext that is also all zeros, meaning an attacker who resends the same zero-filled logon attempt over and over hits a valid one within a few hundred tries — without knowing any password. From there the domain controller's machine account password can be set to empty and the entire directory extracted. The patch shipped in August 2020 in two stages, with enforcement mode held back until February 2021, because hardening it outright would have broken older clients.