Windows Netlogon EUVD-2026-99866

Exploitation requires the attacker to already hold valid credentials on the network (PR:L) and network reachability to the Windows Netlogon service, which is enabled by default on domain-joined systems and especially exposed on domain controllers. The flaw stems from Netlogon allocating resources without limits or throttling (CWE-770), so the triggering condition is submitting enough Netlogon requests to exhaust server resources. No user interaction is needed (UI:N). Limiting factors: this is authenticated-only (unauthenticated anonymous attackers cannot exploit it), impact is restricted to denial of service (no data disclosure or modification), and CISA SSVC assesses it as not automatable, reducing the likelihood of mass/worming exploitation.

This is a moderate-priority, availability-only vulnerability rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) indicates a network-reachable, low-complexity attack that nevertheless requires the attacker to already hold valid low-level credentials (PR:L) - so it is authenticated, not anonymous, which meaningfully narrows the threat population to domain-joined or otherwise authorized network principals. Impact is confined to availability (A:H) with no confidentiality or integrity loss, consistent with the CWE-770 resource-exhaustion / Netlogon denial-of-service described. All exploitation signals point the same direction and are mutually consistent: CISA SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'; there is no CISA KEV listing and no public POC, so the status is no public exploit identified at time of analysis. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. The combination of authenticated access, non-automatable exploitation, and availability-only impact means that despite the ubiquity of Windows, this is a manageable patch-on-cycle item for most environments rather than a drop-everything issue - prioritize domain controllers and Netlogon-exposed servers given a patch is already available from Microsoft.

An attacker who already possesses valid low-privileged network credentials sends a stream of crafted Netlogon requests to a vulnerable Windows host, causing unthrottled resource allocation that exhausts the target and denies the service to legitimate users. No public exploit code is known, and exploitation cannot be automated per CISA SSVC, so the scenario assumes a deliberate authenticated adversary on a reachable network segment.