Windows Netlogon CVE-2026-70090

Exploitation requires the attacker to already have local, interactive or authenticated access to an affected Windows system (AV:L, PR:L) and to be able to invoke the vulnerable Netlogon code path; no user interaction is needed (UI:N). The limiting factors are significant: there is no network vector, so a foothold with valid low-privilege credentials on the host is a prerequisite, and the outcome is confined to information disclosure (C:H, I:N, A:N) of uninitialized memory whose contents are not attacker-controlled and may not always contain useful secrets. Affected builds span Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025; patched builds listed in the EUVD advisory remediate it.

This is a genuinely low-to-moderate priority issue despite the CVSS 5.5 (MEDIUM) rating, and the multiple signals are consistent rather than conflicting. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a local, low-complexity, authenticated attack that yields high confidentiality impact but no integrity or availability impact - a classic information-disclosure primitive from a CWE-908 use-of-uninitialized-resource bug in Netlogon. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed exploitation), Automatable=no (cannot be mass-scripted because it requires local authenticated access), and Technical Impact=partial. There is no EPSS score provided, no CISA KEV listing, and no public proof-of-concept, so there is no public exploit identified at time of analysis. The main value of this disclosure is as a building block - leaked memory (potentially containing secrets, pointers, or tokens) can aid privilege-escalation or defeat ASLR - rather than as a standalone compromise. All signals point the same direction: a real but low-severity defense-in-depth fix, not an emergency.

A low-privileged but authenticated user already present on a Windows host interacts with the local Netlogon service and triggers the use of an uninitialized resource, causing previously-used memory contents to be returned to them. The attacker harvests the leaked bytes hoping to recover sensitive data (credentials, pointers, or other process memory) to stage further local privilege escalation. No public proof-of-concept exists, and the attack requires local access plus valid credentials, so it is not remotely or automatically exploitable.