EUVD-2026-73257
GHSA-cxvx-6h36-g9mq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated, network-reachable Netlogon RPC overflow needing no user interaction yields full RCE and full C/I/A impact on the target host.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in the Windows Netlogon service affects a broad range of Windows client and server releases (Windows 10, Windows 11 through 26H1, and Windows Server 2012 through 2025), where a stack-based buffer overflow lets an unauthenticated network attacker run arbitrary code. Because Netlogon underpins the secure channel between domain members and domain controllers, exploitation against a DC can lead to full domain compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Windows Netlogon RPC endpoint (MS-NRPC over SMB/RPC), which is exposed by default on domain controllers and domain-joined systems; per CVSS AV:N/AC:L/PR:N/UI:N no authentication, no user interaction, and no special non-default configuration are required beyond the target running an unpatched, affected Windows build with Netlogon active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a pre-authentication, low-complexity, network-reachable RCE with full impact, and the affected surface - Netlogon on domain controllers and members - makes this a top-priority patch for any Active Directory environment; even a mid-sized municipal IT team should treat this as urgent given how central Netlogon is to domain trust. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update for CVE-2026-72982 to every affected system; the fix is delivered through the standard monthly cumulative/security update, so upgrade each SKU to at or above its listed patched build (for example Windows Server 2025 10.0.26100.33438, Server 2022 10.0.20348.5622, Server 2019/1809 10.0.17763.9245, Server 2016/1607 10.0.14393.9512, Windows 11 24H2 10.0.26100.9445), following Microsoft's MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72982. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, create an inventory of all affected Windows systems (Windows 10, 11, Server 2012-2025), identify which are domain controllers or other critical infrastructure, and assess network-accessible exposure to untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today