Summary
| Parameter | Value |
|---|---|
| CVE ID (lead entry) | CVE-2026-72982 |
| Vulnerabilities covered | 6 (CVE-2026-72982, CVE-2026-73009, CVE-2026-73010, CVE-2026-73025, CVE-2026-77493, CVE-2026-78445) |
| Alert source | GitHub Advisory - critical vulnerabilities |
| CVE year | 2026 |
| Publication date | 2026-09-08 |
| Vendor | Microsoft |
| Product | Windows / Windows Server |
| CVSS Score | 9.8 (Critical) — all six |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Microsoft’s September patch release contains six vulnerabilities rated 9.8 on CVSS. What they share is that they affect components which listen on the network — rather than, as with the privilege escalation flaws, code that runs locally.
| CVE | Component | Vulnerability class | Impact |
|---|---|---|---|
| CVE-2026-72982 | Windows Netlogon | stack-based buffer overflow | unauthenticated remote code execution |
| CVE-2026-73009 | Windows SSTP (Secure Socket Tunneling Protocol) | use-after-free | unauthenticated remote code execution |
| CVE-2026-73010 | Windows Failover Cluster | use-after-free | unauthenticated remote code execution |
| CVE-2026-73025 | Windows iSCSI | weak authentication | security feature bypass (not code execution) |
| CVE-2026-77493 | Microsoft Graphics Component | double free | unauthenticated remote code execution |
| CVE-2026-78445 | Windows Services for NFS (ONCRPC XDR driver) | use-after-free | unauthenticated remote code execution |
Five of the six allow an unauthenticated attacker to execute code over the network. The sixth, CVE-2026-73025 in iSCSI, has a different impact — a security feature bypass — despite the identical numeric score. That detail is worth noticing, because it is easy to compress six entries into a single internal message reading “six remote code execution flaws”, which would simply not be true.
Netlogon is the special case here. The other five components are optional roles — a server has them only if someone deliberately enabled them. Netlogon is different: it is the Active Directory authentication service, present on every domain controller. Unauthenticated remote code execution on a domain controller is not a local incident; it is control over the mechanism that decides who is who across the whole organisation.
What this alert does not contain. None of these six vulnerabilities is currently in the CISA KEV catalog, and there are no public reports of exploitation. This is the opposite of the two privilege escalation flaws from the same patch release, which carry a lower score (7.8) but are actively exploited. If you have to set an order, those are more urgent — despite the lower number.
Required Actions
- Install the September cumulative updates on all Windows servers, starting with domain controllers (CVE-2026-72982) and cluster nodes (CVE-2026-73010).
- Inventory which of these roles are actually enabled. Four of the six components — SSTP, Failover Cluster, iSCSI and Services for NFS — are optional roles. In many organisations they are unused, or present on only a few machines. The real attack surface is often far smaller than the count of six suggests — but that needs verifying, not assuming.
- Check SSTP exposure. If a VPN server running SSTP is exposed to the internet, it is a component reachable by any attacker with no foothold in the internal network at all. That is the shortest path among all six.
- Disable roles you do not use. If the inventory turns up Services for NFS or an iSCSI Target enabled on a server that does not need it, disabling the role removes the vulnerability permanently — unlike a patch, which only protects until the next flaw in the same component.
- Review segmentation around domain controllers. Netlogon must be reachable from workstations, but it does not need to be reachable from every subnet, from guest Wi-Fi, or from the OT network. Restricting that access reduces the impact of far more than this one flaw.
Who Is Affected?
The vulnerabilities affect Windows and Windows Server — Microsoft publishes the exact version lists for each CVE in the MSRC portal (links below).
In practice, the most exposed organisations are those running their own server infrastructure on Active Directory. A domain controller always has Netlogon, so CVE-2026-72982 affects every environment with an AD domain — no exceptions, and no option to disable the role.
The remaining five affect narrower groups: companies using high-availability clusters, Windows as a VPN server (SSTP), iSCSI storage, and mixed Windows-Unix environments where the Services for NFS role is enabled. That last one is often enabled for historical reasons, left over from an integration retired long ago — and then nobody remembers it is there.
Sources
- NVD - CVE-2026-72982
- NVD - CVE-2026-73009
- NVD - CVE-2026-73010
- NVD - CVE-2026-73025
- NVD - CVE-2026-77493
- NVD - CVE-2026-78445
- Microsoft MSRC - CVE-2026-72982
- Microsoft MSRC - CVE-2026-73009
- Microsoft MSRC - CVE-2026-73010
- Microsoft MSRC - CVE-2026-73025
- Microsoft MSRC - CVE-2026-77493
- Microsoft MSRC - CVE-2026-78445
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
How many vulnerabilities does this alert cover?
Six, all rated 9.8 on CVSS and all from Microsoft's September patch release: CVE-2026-72982 (Netlogon), CVE-2026-73009 (SSTP), CVE-2026-73010 (Failover Cluster), CVE-2026-73025 (iSCSI), CVE-2026-77493 (Graphics Component) and CVE-2026-78445 (Services for NFS). We cover them together because they share one trait: they affect components that listen on the network and require the same response.
Are all six remote code execution?
No, five are. CVE-2026-72982, 73009, 73010, 77493 and 78445 allow an unauthenticated attacker to execute code over the network. CVE-2026-73025 in the iSCSI component is a security feature bypass through weak authentication - a different impact, despite the identical score.
Which of these is most dangerous in a typical company?
CVE-2026-72982 in Netlogon. Netlogon is the Active Directory authentication service and runs on every domain controller - unlike the other components, whose presence depends on which roles are enabled. Unauthenticated remote code execution on a domain controller means control over authentication across the entire organisation.
Are these vulnerabilities being exploited?
As of this alert's publication, none of the six is in the CISA KEV catalog and there are no public reports of exploitation. This is the opposite of the two privilege escalation flaws from the same patch release, which are actively exploited despite a lower CVSS score.
What should we do beyond installing patches?
Inventory which of these components are actually enabled and reachable over the network in your environment. Four of the six - SSTP, Failover Cluster, iSCSI and Services for NFS - are optional roles that many organisations either do not use or run on only a handful of servers. The real attack surface is often far smaller than the count of six suggests, but this needs to be verified rather than assumed.
