CVE-2026-62759: Windows Netlogon Auth Bypass Vulnerability

CVE-2026-62759 Overview

CVE-2026-62759 is an authentication bypass vulnerability in Windows Netlogon that allows an unauthorized attacker to perform spoofing over an adjacent network. The flaw is classified under [CWE-290] (Authentication Bypass by Spoofing) and impacts the integrity, confidentiality, and availability of affected systems. Microsoft published the advisory on 2026-09-08 through the Microsoft Security Response Center (MSRC).

Critical Impact
An adjacent-network attacker can bypass Netlogon authentication through spoofing, potentially impersonating domain accounts and compromising Active Directory trust relationships.

Affected Products

Windows (Netlogon component) — refer to the Microsoft Security Update CVE-2026-62759 advisory for the complete list of affected builds
Windows Server deployments running the Netlogon Remote Protocol (MS-NRPC)
Domain-joined Windows client systems participating in secure channel communications

Discovery Timeline

2026-09-08 - CVE-2026-62759 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-62759

Vulnerability Analysis

The vulnerability resides in the Windows Netlogon service, which handles the secure channel used by domain-joined systems to authenticate against domain controllers. Netlogon implements the MS-NRPC remote protocol and is central to trust establishment between workstations, member servers, and Active Directory.

An authentication bypass by spoofing weakness allows an attacker positioned on an adjacent network to impersonate a trusted party during the Netlogon authentication exchange. Successful exploitation undermines the integrity of the secure channel and can lead to unauthorized access to domain resources.

The attack complexity is high, meaning the attacker must satisfy specific network-timing or protocol-state conditions before spoofing succeeds. No user interaction is required, and no prior authentication is needed to initiate the attack.

Root Cause

The root cause is improper identity verification within the Netlogon authentication flow. Under [CWE-290], the service accepts spoofed identity assertions when the attacker manipulates protocol fields the server does not validate strongly enough. This weakens the guarantee that the peer participating in the secure channel is the legitimate account holder.

Attack Vector

Exploitation requires adjacent-network access, meaning the attacker must reside on the same broadcast domain, VLAN, or logically adjacent network segment as the target. The attacker sends crafted Netlogon protocol messages that impersonate a legitimate principal during authentication negotiation. Because privileges required are none and user interaction is none, any adjacent host capable of reaching the Netlogon service can attempt the attack. Microsoft has not published proof-of-concept code, and no public exploit is currently available. Consult the Microsoft Security Update CVE-2026-62759 advisory for protocol-level technical details.

Detection Methods for CVE-2026-62759

Indicators of Compromise

Unexpected Netlogon secure channel resets or repeated NetrServerAuthenticate calls originating from non-domain-controller hosts on the same subnet
Windows Security Event Log entries showing anomalous computer account authentications, particularly Event IDs 4624, 4742, and 5805
Spikes in MS-NRPC (RPC over TCP port 135 and dynamic ports) traffic from unusual internal source addresses

Detection Strategies

Baseline legitimate Netlogon traffic patterns and alert on deviations, especially authentication attempts from workstations to unrelated domain controllers
Correlate System Event Log entries from the Netlogon service (source NETLOGON) with authentication events on domain controllers
Monitor for repeated secure channel establishment failures followed by successful authentications from the same source

Monitoring Recommendations

Forward Netlogon operational logs and domain controller Security logs to a centralized SIEM for cross-host correlation
Deploy network sensors on segments containing domain controllers to inspect MS-NRPC traffic for anomalies
Track computer account password changes and secure channel resets, which can indicate spoofing attempts or forced re-authentication

How to Mitigate CVE-2026-62759

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-62759 advisory to all domain controllers and domain-joined systems
Prioritize patching of domain controllers, which are the primary target for Netlogon spoofing attacks
Audit adjacent-network access to domain controllers and restrict subnets that can reach the Netlogon service

Patch Information

Microsoft has released a security update addressing CVE-2026-62759. Administrators should install the update through Windows Update, Windows Server Update Services (WSUS), or their standard patch management workflow. Refer to the Microsoft Security Update CVE-2026-62759 advisory for the specific KB article and build numbers applicable to each Windows version.

Workarounds

Segment domain controllers into dedicated VLANs and enforce strict access control lists to limit adjacent-network exposure
Enable and enforce Netlogon secure channel signing and sealing through Group Policy where supported
Restrict RPC endpoint mapper and Netlogon dynamic port ranges using host-based firewalls on domain controllers

bash

# Example Group Policy setting to enforce secure Netlogon channel
# Computer Configuration > Windows Settings > Security Settings >
# Local Policies > Security Options

Domain member: Digitally encrypt or sign secure channel data (always) = Enabled
Domain member: Digitally encrypt secure channel data (when possible) = Enabled
Domain member: Digitally sign secure channel data (when possible) = Enabled
Domain member: Require strong (Windows 2000 or later) session key = Enabled