Windows Netlogon CVE-2026-70025

Requires the attacker to already hold valid low-privilege authenticated access to the network (PR:L) and to reach the Netlogon RPC interface, which is exposed on Windows domain controllers. Exploitation is limited by high attack complexity (AC:H), consistent with a use-after-free that depends on winning a race/timing window rather than a deterministic single request; no user interaction is required (UI:N). Impact is restricted to denial of service against the Netlogon service (A:H only; no confidentiality or integrity impact), meaning the realistic outcome is disruption of domain authentication, not system compromise. Affected builds span Windows 10/11 (through 24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 below the patched build numbers listed in the EUVD data.

This is a moderate-severity, availability-only issue that is NOT a top-tier priority despite affecting a critical Windows component. All signals align toward low real-world urgency: the CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.3) shows network reach but requires an authenticated attacker (PR:L) and high attack complexity (AC:H), with impact confined to availability (C:N/I:N/A:H) - a denial of service, not code execution or data compromise. CISA's SSVC decision framework reinforces this: Exploitation=none, Automatable=no, Technical Impact=partial, which maps to a 'Track' rather than 'Act' disposition. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided in the input (EPSS data is MISSING - cannot quantify exploitation probability). The AC:H and PR:L requirements (likely a race condition in a use-after-free reachable only by an already-authenticated principal) further reduce the practical threat. No signals conflict; they consistently indicate a low-to-moderate, non-urgent patch-in-normal-cycle item. The main caveat is the component itself - Netlogon runs on domain controllers, so a crash can disrupt domain-wide authentication, giving this a higher operational blast radius than its 5.3 score alone suggests.

An attacker who already holds low-privilege authenticated access on the network sends specially crafted Netlogon RPC traffic to a Windows domain controller, triggering a use-after-free race condition that crashes the Netlogon service and disrupts domain authentication for connected clients. Because attack complexity is high (AC:H), reliable triggering likely requires winning a timing/race window, and no public exploit code is identified at time of analysis.