Windows Netlogon EUVD-2026-44100

Exploitation requires the attacker to already hold low-level privileges (PR:L) and network access to the Netlogon RPC interface of a vulnerable host - i.e. an authenticated position such as a valid domain/machine account able to reach the target's MS-NRPC endpoints. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must first authenticate and reach the RPC endpoint, so hosts with Netlogon RPC restricted to trusted networks are less exposed; the target must be an unpatched build below the fixed versions listed in the EUVD data; and reliable exploitation of a use-after-free is inherently non-deterministic, consistent with SSVC Automatable:no. This is not remote-unauthenticated: PR:L in the CVSS vector confirms authentication is required.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity attack that requires only low existing privileges and no user interaction, with total confidentiality, integrity, and availability impact - consistent with the SSVC 'total' technical impact rating. However, the other signals temper urgency: SSVC marks Exploitation as 'none' and Automatable as 'no', EPSS is low at 0.62% (46th percentile), there is no KEV listing, and no public POC is referenced. The signals are broadly consistent rather than conflicting: high inherent impact but no evidence of exploitation and non-trivial reliability (use-after-free primitives are often unstable, which aligns with Automatable:no). This is a patch-in-normal-cycle item for most environments but should be prioritized on domain controllers and other exposed servers given Netlogon's privileged role and the very large install base.

An attacker who has already gained a low-privileged foothold on the network (for example a standard domain account or an authenticated machine) sends crafted Netlogon RPC requests to a vulnerable Windows host to trigger the use-after-free and corrupt privileged memory, elevating to SYSTEM-level control. Given AV:N/AC:L/PR:L, this requires network reach and prior authentication but no user interaction; no public exploit code is currently identified, and the unstable nature of use-after-free primitives (SSVC Automatable:no) makes reliable weaponization non-trivial.