Windows Netlogon CVE-2026-72982

Exploitation requires network reachability to the Windows Netlogon RPC endpoint (MS-NRPC over SMB/RPC), which is exposed by default on domain controllers and domain-joined systems; per CVSS AV:N/AC:L/PR:N/UI:N no authentication, no user interaction, and no special non-default configuration are required beyond the target running an unpatched, affected Windows build with Netlogon active. The practical limiting factor is network exposure: hosts whose RPC/SMB ports are firewalled from untrusted networks are far less reachable, and successful memory-corruption code execution must still contend with Windows stack-protection mitigations (stack cookies, DEP, ASLR), which may raise real-world difficulty above the AC:L rating.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a pre-authentication, low-complexity, network-reachable RCE with full impact, and the affected surface - Netlogon on domain controllers and members - makes this a top-priority patch for any Active Directory environment; even a mid-sized municipal IT team should treat this as urgent given how central Netlogon is to domain trust. That said, several exploitation-difficulty signals are absent: EPSS is not provided, there is no POC, and it is not in CISA KEV, so real-world exploitation is unconfirmed and the 9.8 currently reflects theoretical worst-case reachability rather than demonstrated mass exploitation. Memory-corruption RCE against a hardened Windows service often requires bypassing stack cookies, ASLR, and DEP, so weaponization may be non-trivial despite the low AC rating - a factor to weigh against the raw score. On balance, patch prioritization should be driven by the criticality and network exposure of domain controllers rather than by an exploitation probability that the available data does not yet establish.

An attacker with network access to a domain controller or Windows host sends crafted Netlogon RPC requests that overflow a stack buffer in the Netlogon service, corrupting the stack to redirect execution into attacker-supplied code. No credentials or user interaction are required per the CVSS vector, so a single reachable, unpatched DC could be compromised and used as a pivot toward full domain takeover. No public POC has been identified at time of analysis.