CVE-2026-72982 – Windows Netlogon Remote Code Execution Vulnerability

CVE-2026-72982 is a critical stack-based buffer overflow vulnerability in Windows Netlogon. An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. The vulnerability requires no privileges or user interaction and can result in high impact to confidentiality, integrity, and availability.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: An attacker can target the vulnerable Netlogon service remotely over the network. Attack complexity is low, and successful exploitation can allow remote code execution with high confidentiality, integrity, and availability impact. No authentication or user interaction is required.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as Unproven, and the exploitation assessment is Exploitation Unlikely. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability is caused by a stack-based buffer overflow (CWE-121) in Windows Netlogon. An unauthenticated remote attacker could send a specially crafted packet to an affected service over the network. Successful exploitation could trigger the memory corruption condition and allow the attacker to execute code on the target system. The attack has low complexity, requires no privileges, requires no user interaction, and does not change security scope. Successful exploitation can have high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and applicable 32-bit, x64, and ARM64 editions. Exploitation can occur remotely by sending a specially crafted packet to an affected service.

BUSINESS IMPACT: Successful exploitation could allow an unauthorized remote attacker to execute code on an affected Windows system. Because confidentiality, integrity, and availability impacts are all rated High, compromise could expose sensitive information, enable unauthorized changes, and disrupt system availability. The lack of authentication and user interaction significantly reduces the barriers an attacker must overcome.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, so affected systems should be updated using their applicable security update.

URGENCY: This vulnerability carries a Critical severity and a CVSS base score of 9.8. Its network attack vector, low attack complexity, lack of authentication, and lack of user interaction create a serious remote-code-execution risk. Although exploitation is currently assessed as unlikely and no active exploitation is identified, affected systems should be prioritized for deployment of the official fix.