Microsoft has disclosed a stack-based buffer overflow in Windows Netlogon, scored CVSS 9.8, which Microsoft states could allow an unauthorized attacker to execute code over a network. The advisory lists affected builds across the currently supported Windows client and server releases.
What Is It
CVE-2026-72982 is a stack-based buffer overflow in Windows Netlogon. Per Microsoft's description, the flaw "allows an unauthorized attacker to execute code over a network." The CVSS 3.1 vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, puts it at 9.8 CRITICAL: network-reachable, low attack complexity, no privileges, and no user interaction required, with total loss of confidentiality, integrity, and availability. That score reflects Microsoft's own assessment of the vector; the CVE was published 2026-09-08 by Microsoft ([email protected]) and remains in "Awaiting Analysis" status at NVD, so the scoring has not yet been independently reviewed.
Why It Matters
Netlogon is a core domain authentication service, and per Microsoft's characterization this bug requires no credentials and no user action to reach. If that characterization holds, the combination of pre-authentication remote code execution and a service that sits at the heart of Active Directory domain trust is among the worst pairings for enterprise networks. As of this writing, CVE-2026-72982 does not appear in the CISA Known Exploited Vulnerabilities catalog, and no public reporting of active exploitation has been identified; absence from the catalog is not evidence that exploitation is impossible, only that none has been confirmed and cataloged.
What's Vulnerable
Microsoft lists the affected builds as anything below the following, across 32-bit, x64, and ARM64 platforms where applicable:
| Product | Fixed at build |
|---|---|
| Windows 10 1607 / Server 2016 (incl. Server Core) | 10.0.14393.9512 |
| Windows 10 1809 / Server 2019 (incl. Server Core) | 10.0.17763.9245 |
| Windows 10 21H2 | 10.0.19044.7725 |
| Windows 10 22H2 | 10.0.19045.7725 |
| Windows 11 23H2 | 10.0.22631.7582 |
| Windows 11 24H2 / Server 2025 (incl. Server Core) | 10.0.26100.9445 |
| Windows 11 25H2 | 10.0.26200.9445 |
| Windows 11 26H1 | 10.0.28000.2954 |
| Windows Server 2012 (incl. Server Core) | 6.2.9200.26349 |
| Windows Server 2012 R2 (incl. Server Core) | 6.3.9600.23397 |
| Windows Server 2022 | 10.0.20348.5622 |
Windows 11 24H2 and Windows Server 2025 share the 26100 servicing branch and are patched by the same cumulative update, so they are listed together here. Source data for this brief carried a divergent revision number for the Server 2025 entry; administrators validating patch state on that SKU should confirm the exact fixed build against the Security Update Guide entry rather than relying on the table above.
Patch Status
Patched builds are published for every affected product listed above. Apply the Microsoft update that brings each system to at or above its listed fixed build. Because the CVE is not listed in the CISA KEV catalog, no BOD 22-01 remediation due date or required action currently applies to U.S. federal civilian agencies. No vendor-supplied workaround or mitigation is documented in the advisory, which makes patching the only available remediation.
Sources
- Microsoft Security Response Center; Security Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72982
- NVD, CVE-2026-72982: https://nvd.nist.gov/vuln/detail/CVE-2026-72982
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog