CVE-2026-72982 Netlogon Remote Code Execution: Verify the Fix

Executive Summary

CVE-2026-72982 Netlogon remote code execution requires an urgent patch-status check on every affected domain controller. Microsoft's September 2026 CVRF describes a network-reachable stack buffer overflow that needs neither authentication nor user interaction. The practical priority is to identify each server's exact Windows product, confirm its applicable security update, and verify that deployment and the required restart completed.

Checked on October 3, 2026: Microsoft rates the vulnerability Critical with a CVSS 3.1 base score of 9.8. Its entry was initially published on September 8, 2026; this is a September vulnerability being reviewed in October, not a new October disclosure. The facts below come from the MSRC September 2026 CVRF JSON.

The CVE is absent from CISA KEV as checked on October 3, 2026, in the downloaded KEV catalogue, version 2026.10.02. That observation and Microsoft's exploitation assessment are separate snapshots. Neither proves that exploitation cannot occur or justifies postponing the update.

CVE-2026-72982 Netlogon Remote Code Execution

Microsoft describes an attacker sending a specially crafted network packet to an affected service and potentially executing code on the target system. The weakness is a stack-based buffer overflow. The published FAQ explicitly removes two common prerequisites: the attacker does not need an account, and a user does not need to click or approve anything. Network access to the affected service remains necessary.

For defenders, the immediate question is therefore which affected systems remain reachable and unpatched. The CVRF does not provide a packet signature, a dedicated exploit event, or evidence of an active campaign. Do not infer a specific payload, process chain, privilege level after exploitation, or wormable behavior from the score alone.

This is a separate vulnerability from Zerologon CVE-2020-1472 enforcement. That article discusses the older Netlogon secure-channel flaw and its enforcement history. Those settings and historical fixes do not establish whether the September 2026 buffer-overflow fix is installed.

Verify the Correct Fix for Each Domain Controller

Start with a complete DC inventory, including Server Core installations and read-only domain controllers. Record the OS product, installed build, applicable KB, deployment result, and restart completion for each machine. Avoid checking one visible DC and extrapolating its result to the forest.

The following Windows Server mapping is joined directly from this CVE's Remediations and the CVRF ProductTree. It covers the server products listed there; the document also lists Windows client products. Use the full CVRF for client remediation.

Every security-update remediation above has RestartRequired set to Yes. The 2012 and 2012 R2 entries are Monthly Rollup entries; do not generalize installation eligibility from this table. Check your applicable servicing arrangements. A matching version number from a different Windows product is not evidence of coverage.

For a Windows Server 2025 DC, Microsoft's Get-HotFix documentation documents filtering by -Id and querying a remote computer with -ComputerName. Adapt its documented pattern to the applicable KB:

Get-HotFix -Id KB5122871

For a remote Server 2025 DC, replace the example name with your actual host:

Get-HotFix -Id KB5122871 -ComputerName DC01

These commands were verified against the documentation, not run against a production DC. Substitute the table's KB for another server version. A returned record supports that the named update is installed; it does not prove that its required restart has completed. An access or connectivity error is an unknown result, not a missing-patch finding.

Get-HotFix uses Win32_QuickFixEngineering and has documented inventory limitations. A missing historical KB alone is not a conclusive vulnerability verdict: reconcile the installed build and servicing history, including any superseding cumulative update, in your patch-management records. Do not use only the newest update's installation date as proof of this CVE's coverage.

For Server 2025, Microsoft's KB5122871 page independently confirms OS Build 26100.33438. The same page states that the RDS issue introduced by the September update was resolved in updates released on or after September 14, 2026, including KB5129235, and recommends the latest applicable update. Treat the table as the original fix mapping, then evaluate the current applicable cumulative update and known issues before rollout.

Detection: Useful Signals and Their Limits

The highest-confidence exposure check here is patch compliance for the exact OS product. Alert on an affected DC whose applicable fix or verified superseding update is missing, whose deployment failed, or whose restart is still pending. Keep inaccessible and stale inventory records in an explicit unknown queue until someone verifies them.

Microsoft Learn's Appendix L: Events to monitor documents two Netlogon events:

These are secure-channel posture signals, not documented CVE-2026-72982 exploit indicators. Their presence does not establish successful RCE; their absence does not establish that a DC is patched. Review them alongside patch status and your existing endpoint and network telemetry, rather than writing an alert that labels every occurrence as this CVE.

Microsoft recommends testing event-monitoring recommendations in the local environment and reviewing logging configuration. Confirm collection is operating on every DC before interpreting a quiet dashboard. No CVE-specific KQL detection is supplied in the primary advisory used here; there is no verified exploit signature to reproduce.

Remediation: Patch, Restart, and Close Unknowns

1. Match the product before selecting the update. Use the CVRF ProductID and remediation for that server version, then review the applicable current cumulative update and its prerequisites.
2. Deploy through your established update channel. Prioritize reachable, unpatched DCs and plan the work around authentication availability. Preserve the update result for each host.
3. Complete the required restart. A downloaded package, an approved deployment, or an installed-hotfix row is not the same as a completed maintenance operation.
4. Recheck the running build and update evidence. Reconcile the KB/build mapping, any supersedence, and deployment records. Validate authentication and replication before closing the change.
5. If immediate patching is blocked, reduce unnecessary network reachability. Restrict access from untrusted segments while preserving required domain traffic, record the temporary control's scope, and set a patch deadline. This is an exposure-reduction recommendation, not a Microsoft-documented workaround for the bug.
6. Escalate suspicious activity through incident response. Preserve relevant telemetry and investigate independently of the patch rollout. Installing the update does not settle whether earlier suspicious activity involved compromise.

Our August 2026 domain-controller RCE review explains why role-aware inventory matters across DNS, AD CS, and AD DS. Use that operational lesson here while retaining the distinct September Netlogon CVE and its product-specific remediation.

How EtcSec Detects This

For this CVE, the exposure check must verify the actual patch level against the Microsoft product and fix mapping above. Configuration posture alone cannot answer that question. This article does not associate a collector vulnerability tag with CVE-2026-72982 because no dedicated detector implementation has been verified for this workflow.

Keep EtcSec posture findings alongside the patch-compliance evidence, with their coverage stated separately. An older Zerologon enforcement finding, a clean configuration audit, or a generic OS finding must not be presented as proof that this Netlogon RCE is detected or remediated. Close this CVE only with the applicable update, running-build, and restart evidence for each affected server.