CVE-2026-72982: Critical Unauthenticated Netlogon RCE Puts Every Unpatched Domain Controller at Risk

CVE-2026-72982, patched in Microsoft’s September 2026 security release, is a critical, unauthenticated remote code execution flaw in the Windows Netlogon service, CVSS 9.8, no user interaction required. A successful exploit hands an attacker code execution directly on a domain controller, which in practice means immediate access to the NTDS.dit database, Kerberos keys, and the ability to forge authentication artifacts for any account in the domain. If you have not patched your domain controllers against September’s release yet, this is the single item that should move to the top of the list.

Why this specific flaw is so severe

Netlogon handles domain logon requests, secure channel establishment between domain members and domain controllers, and machine account password updates, it sits at the core of how Active Directory authenticates everything on the domain. CVE-2026-72982 is a stack-based buffer overflow (CWE-121) reachable by sending a specially crafted packet to the Netlogon service. Critically, it requires no authentication and no user interaction, an attacker with network reachability to a domain controller’s Netlogon service can attempt exploitation directly, no phishing, no credential theft prerequisite, no insider access needed first.

Compromise of a single domain controller through a flaw like this is effectively compromise of the entire domain. Anyone who gains code execution on a DC can extract the NTDS.dit database (containing every account’s password hash), access Kerberos signing keys, and from there forge Golden Tickets or otherwise impersonate any account, including Domain Admins, indefinitely until every affected key material is rotated.

What to do right now

# Confirm which domain controllers are still missing the September 2026 cumulative update
Get-ADDomainController -Filter * | ForEach-Object {
    Invoke-Command -ComputerName $_.HostName -ScriptBlock {
        Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date "2026-09-08") }
    }
}

# Cross-reference against Microsoft's Security Update Guide entry for
# CVE-2026-72982 directly to confirm the exact build number your specific
# OS version needs, don't assume a build number from memory

Patch every domain controller first, before any other server in the environment, this is exactly the kind of flaw where the blast radius of an unpatched DC vastly outweighs the inconvenience of an unscheduled patch window. If your organization has domain controllers that can’t be patched immediately (a legacy application dependency, a change-freeze window), restricting network access to the Netlogon service (port 445/TCP and the associated RPC endpoint mapping) to only the hosts that genuinely need it is a partial mitigation, not a substitute for patching, but meaningfully reduces exposure while you close the actual gap.

If you suspect a domain controller was already compromised

Given the severity and the fact that domain controllers are frequently high-value, well-monitored targets, treat any DC that was unpatched and reachable from outside a tightly trusted management network as worth a closer look, not just a routine patch-and-move-on. Review DC security event logs for anomalous Netlogon-related crashes or restarts around the time this CVE became public knowledge, unexpected service account activity, and any signs of newly created or modified privileged accounts. If a DC was genuinely compromised, patching it afterward does not undo what an attacker already extracted, a full credential reset (including the krbtgt account, twice, per Microsoft’s documented Golden Ticket remediation guidance) is the appropriate response, not just closing the hole going forward.

The broader pattern worth internalizing

This is another entry in a recurring category: critical, unauthenticated RCE flaws in core Active Directory authentication components, Netlogon, Kerberos, the KDC, DNS running on domain controllers. September 2026’s Patch Tuesday specifically included Critical RCE vulnerabilities across several of these authentication-central components simultaneously. Domain controllers and other identity-supporting infrastructure should always be the first systems evaluated and patched in any given cycle, not scheduled alongside general workstation patching, given how disproportionate the impact of a DC compromise is compared to almost any other single system in the environment.

Frequently asked questions

Is CVE-2026-72982 known to be actively exploited?
Check Microsoft’s Security Update Guide entry and CISA’s Known Exploited Vulnerabilities catalog directly for the current status, exploitation status can change quickly after a patch’s technical details become more widely understood, so treat “not yet observed” as a narrow window to patch, not a reason to deprioritize it.

We have domain controllers that are hard to patch quickly due to change control. What’s the minimum interim mitigation?
Restrict network reachability to the Netlogon service on those DCs to only the specific hosts and management subnets that genuinely need it, this reduces the population of potential attackers who can even reach the vulnerable service. This is a stopgap, not a fix, prioritize getting the actual patch through change control as fast as your process allows given the severity.

Does this affect Azure AD Domain Services or only traditional on-premises Active Directory?
This specific vulnerability is in the Windows Netlogon service as implemented in on-premises Windows Server domain controllers. Confirm against Microsoft’s official advisory for your specific deployment model (on-premises AD DS, Azure AD DS, or a hybrid configuration) rather than assuming applicability either way, managed services may already have mitigations applied on Microsoft’s side but that should be verified, not assumed.