CVE-2026-72982: Windows Netlogon Buffer Overflow Vulnerability

CVE-2026-72982 Overview

CVE-2026-72982 is a stack-based buffer overflow [CWE-121] in the Windows Netlogon service. An unauthenticated attacker can execute arbitrary code over the network by sending crafted Netlogon protocol traffic to a vulnerable system. The flaw requires no user interaction and no prior privileges, making Windows domain controllers and member servers exposing Netlogon a direct target.

Microsoft published the vulnerability advisory on September 8, 2026, tracking it as Microsoft Vulnerability Advisory CVE-2026-72982. The Netlogon service underpins secure channel communication between Windows systems and domain controllers, so successful exploitation risks full domain compromise.

Critical Impact
Unauthenticated remote code execution against Windows Netlogon enables adversaries to seize domain controllers and pivot across an Active Directory environment.

Affected Products

Microsoft Windows (Netlogon service) — refer to the Microsoft advisory for the authoritative list of affected builds
Windows Server systems operating as Active Directory domain controllers
Windows client and server systems running the Netlogon Remote Protocol

Discovery Timeline

2026-09-08 - CVE-2026-72982 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72982

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow in the Windows Netlogon service, classified under [CWE-121]. Netlogon handles authentication traffic and secure channel establishment for domain-joined systems, and it exposes remote procedure call (RPC) interfaces over the network. A malformed request that exceeds the bounds of a fixed-size stack buffer overwrites adjacent stack memory, including saved return addresses and local control data.

Successful exploitation grants code execution in the context of the Netlogon service, which runs with high privileges on the target host. On a domain controller, this effectively hands the attacker control of the directory service. The EPSS score is 0.909% (57.87 percentile) as of 2026-09-10, indicating measurable near-term exploitation likelihood even without a published proof of concept.

Root Cause

The root cause is missing or insufficient bounds validation when Netlogon parses attacker-controlled fields from an incoming network message. A length or size value derived from the request is used to copy data into a fixed stack buffer without enforcing that the input fits. This produces a classic stack smash that corrupts control-flow structures.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network reachability to the Netlogon RPC endpoint on a vulnerable host sends a crafted request that triggers the overflow. In typical Active Directory deployments, domain controllers are reachable from every domain-joined workstation, which broadens the internal blast radius even when perimeter exposure is limited.

No verified public exploit code is available at publication time. See the Microsoft Vulnerability Advisory CVE-2026-72982 for technical details.

Detection Methods for CVE-2026-72982

Indicators of Compromise

Unexpected crashes, restarts, or Windows Error Reporting (WER) events for the Netlogon service (netlogon.dll hosted in lsass.exe)
Anomalous inbound RPC traffic to Netlogon endpoints from non-domain-controller hosts or unusual source subnets
New or unexpected child processes spawned by lsass.exe on domain controllers following Netlogon activity
Creation of new privileged accounts, replication requests, or DCSync-style activity shortly after suspicious Netlogon traffic

Detection Strategies

Alert on Netlogon service failures and unexpected termination events in the System event log on domain controllers
Correlate RPC traffic to the Netlogon interface with process behavior on the target host to surface post-exploitation activity
Hunt for anomalous outbound connections from domain controllers, a common post-compromise pattern
Baseline Netlogon secure channel traffic patterns and flag deviations in volume, source, or message size

Monitoring Recommendations

Ingest domain controller Security, System, and Sysmon logs into a centralized analytics platform for correlation
Monitor Active Directory replication and privileged group changes for signs of post-exploitation lateral movement
Track patch state of all domain controllers and Netlogon-exposed servers to identify unpatched systems

How to Mitigate CVE-2026-72982

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Vulnerability Advisory CVE-2026-72982 to all Windows systems, prioritizing domain controllers
Inventory every system running the Netlogon service and confirm patch deployment status
Restrict network reachability to Netlogon RPC endpoints so only required hosts can initiate connections
Increase monitoring on domain controllers for service crashes and anomalous RPC traffic during the patch window

Patch Information

Microsoft has released a security update addressing CVE-2026-72982. Consult the Microsoft Vulnerability Advisory CVE-2026-72982 for the authoritative list of affected products, corresponding KB numbers, and installation guidance. Deploy the update through Windows Update, Windows Server Update Services (WSUS), or your configuration management platform.

Workarounds

No official workaround replaces the security update; deploy the patch as soon as testing permits
Enforce network segmentation and host-based firewall rules to limit exposure of Netlogon RPC endpoints to trusted management and domain traffic only
Isolate legacy or unpatched domain controllers from general workstation subnets until updates are applied

bash

# Example: verify Netlogon-related update installation on Windows
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Example: restrict inbound RPC to Netlogon endpoints to trusted management hosts
New-NetFirewallRule -DisplayName "Restrict Netlogon RPC" -Direction Inbound `
  -Protocol TCP -LocalPort 135 -RemoteAddress <trusted_subnet> -Action Allow