Windows Netlogon EUVD-2026-73370

The attacker must be positioned on the same adjacent network segment or VLAN as the target host running Windows Netlogon - typically a domain controller or domain member. This is AV:A: internet-facing exploitation is not possible without prior LAN access. AC:H indicates a non-trivial exploit condition: likely a specific cryptographic state, timing window, or protocol sequence must be achieved, meaning casual or automated mass-exploitation is unlikely. No authentication is required (PR:N) - the bypass is the authentication mechanism itself. No user interaction is needed (UI:N). Exploitation is limited to: (1) attackers with adjacent LAN or VLAN access; (2) ability to craft and deliver Netlogon RPC traffic to the target; and (3) satisfying the unspecified high-complexity precondition. Client systems running Windows 10/11 are also listed as affected, though exploitation impact and realistic targeting is most severe against domain controllers running Windows Server editions.

The CVSS 3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects two meaningful risk-limiting factors: the adjacent-network attack vector (AV:A) restricts exploitation to attackers with LAN or VLAN-level access, ruling out opportunistic internet-facing exploitation; and high attack complexity (AC:H) implies that exploitation is not trivial and likely requires specific protocol state, timing, or environmental conditions. These factors meaningfully differentiate this from a ZeroLogon-class immediately weaponizable threat. On the other hand, the C:H/I:H/A:H impact triad indicates full system compromise if exploitation succeeds, making this a critical priority for any environment where an internal attacker or compromised adjacent host could reach domain controller Netlogon ports. No EPSS score was provided in the source data. The vulnerability is not in CISA KEV, and no public POC or exploit code has been identified at time of analysis, further moderating immediate exploitation risk. For Active Directory-dependent enterprise environments, patching should nonetheless be prioritized given historical exploitation patterns on Netlogon-class flaws.

An attacker with access to the same network segment as a Windows domain controller - whether through physical LAN access, a compromised workstation, or a misconfigured VLAN - sends crafted Netlogon RPC messages that exploit the spoofing flaw to authenticate as a privileged domain account without valid credentials. If the high-complexity conditions are met (specific protocol timing or state), the attacker gains full control over the targeted system, enabling credential harvesting or lateral movement across the Active Directory environment. No public POC exists at time of analysis, so exploitation likely requires purpose-built tooling.