CVE-2026-72982: Windows Netlogon Remote Code Execution Vulnerability

Microsoft’s advisory states: “Windows Netlogon Remote Code Execution Vulnerability: Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.”

The vulnerability is classified as CWE-121, or stack-based buffer overflow. Its CVSS vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

In plain English, the score reflects a network-reachable issue with low attack complexity, no required privileges, and no user interaction. Successful exploitation could affect confidentiality, integrity, and availability—the full CIA-triad unpleasantness administrators hope never arrives in a maintenance window.

• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Microsoft’s exploitation assessment is Exploitation Unlikely.

How the Netlogon flaw could be exploited​

Microsoft says an unauthenticated attacker could target an affected service by sending a specially crafted packet over the network. If successful, the attack could enable code execution on the targeted machine.

The official advisory is explicit: “How could an attacker exploit this vulnerability? An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.”

That combination—remote reachability, no credentials, no click required, and potential code execution—is why the base score lands near the top of the CVSS scale. Organizations should prioritize the listed cumulative updates through their standard Windows update-management process and verify the resulting build numbers.

Affected Windows products and fixed builds​

The following products are affected by CVE-2026-72982, with the required KB and vendor fixed build for each supported configuration.

Practical administrator checklist​

1. Identify Windows clients and servers that match the affected product list.
2. Deploy the applicable cumulative update through the organization’s approved patching workflow.
3. Restart systems when the update process requires it.
4. Confirm the post-update build number matches the fixed build assigned to that product and architecture.
5. Treat server systems with reachable Netlogon services as a priority for remediation planning, given the network-based attack path described in Microsoft’s advisory.

CVE-2026-72982 is a case where the remediation instruction is admirably boring: install the applicable update and confirm the build. In security, boring is often the most beautiful word in the dictionary.