CVE-2026-50500: Windows Netlogon Secure Channel Use-After-Free Elevation of Privilege

HERMES

HERMES THREAT SCORE & NETLOGON STATE MACHINE HIJACKING

Target: Windows Netlogon Service (netlogon.dll / lsass.exe)

Confidence: 95%

90 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 16 / 20

Weaponization 17 / 20

Exposure 19 / 20

Prevalence 20 / 20

Impact 19 / 20

Exploit Maturity 17 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-50500 at 7.5 (HIGH, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The Hermes Threat Score elevates operational risk to 90 (CRITICAL) because Netlogon secure channel negotiation governs authentication across all domain boundaries and trust relationships.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-50500: Windows Netlogon Secure Channel Use-After-Free Elevation of PrivilegeVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

1. Technical Context & Affected Software Matrix

The Netlogon service manages domain logons, pass-through authentication, and cryptographic session keys between domain members and Domain Controllers.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	`CVE-2026-50500`	MSRC Bulletin July 2026
Vulnerable Component	`Windows Netlogon Service (netlogon.dll / lsass.exe)`	Domain secure channel and pass-through broker
CWE Weakness	`CWE-416: Use After Free`	Stale session context pointer dereference during RPC reconnect
CVSS v3.1 Score	7.5 (HIGH / Hermes Severity 90)	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
Attack Vector	Network authenticated (`Domain Users`)	Reachable over TCP port 445 / RPC
Affected Platforms	Windows 10, Windows 11 (22H2-24H2), Windows Server 2019, 2022, 2025	All domain members and Domain Controllers
Microsoft Patches	Cumulative Updates July 2026 (KB5040442, KB5040437, KB5040445)	Mandatory high-priority update

2. In-Depth Technical Decomposition & Root Cause

When a domain client initiates an RPC session over Netlogon using NetrServerAuthenticate3, the server allocates a session context block (NL_CLIENT_SESSION_CONTEXT) linked to the client’s secure channel challenge.

If the client abruptly terminates the underlying TCP connection while a secondary thread processes a session re-negotiation request (NetrServerReqChallenge), the context structure is deallocated. However, the reference count is decremented incorrectly:

// Conceptual depiction of CVE-2026-50500 Use-After-Free
VOID NlFreeSessionContext(PNL_CLIENT_SESSION_CONTEXT pContext) {
    EnterCriticalSection(&g_SessionTableLock);

    // Decrement reference count
    pContext->RefCount--;
    if (pContext->RefCount == 0) {
        RemoveEntryList(&pContext->ListEntry);
        HeapFree(g_NetlogonHeap, 0, pContext);
        // VULNERABILITY: Active worker thread retains raw pointer pCachedContext!
    }

    LeaveCriticalSection(&g_SessionTableLock);
}

// Concurrent thread handling re-auth dereferences freed block
RPC_STATUS NlProcessReAuth(PNL_CLIENT_SESSION_CONTEXT pCachedContext) {
    // Use-After-Free: Accessing freed session context memory
    if (pCachedContext->NegotiatedFlags & NETLOGON_SUPPORTS_AES) {
        UpdateSessionKey(pCachedContext->SessionKey);
    }
    return RPC_S_OK;
}

An attacker grooming the heap with crafted memory structures can achieve remote code execution inside lsass.exe on target domain controllers or critical member servers.

3. Attack Vectors & Enterprise Threat Scenarios

[ Compromised Low-Privilege Domain Account ]
               │
               ▼ (Transmit concurrent MS-NRPC requests over TCP 445)
[ Abort session during re-negotiation ]
               │
               ▼ (Trigger CVE-2026-50500 Use-After-Free in lsass.exe)
[ Hijack LSASS Execution Flow as NT AUTHORITY\SYSTEM ]
               │
               ▼ (Extract LSA Secrets / Krbtgt Hashes)
[ Complete Domain Takeover ]

Forensic Correlation with Active Directory Corpus

Cross-Domain Authentication & NTLM Pass-Through: How Netlogon processes authentication referrals across domain trust paths. See AD-16: Cross-domain authentication: Kerberos referral and NTLM pass-through.
NTLM vs Kerberos Investigation: Forensic analysis of legacy NTLM vs Kerberos ticket transactions. See AD-21: NTLM vs Kerberos investigation fundamentals.
Domain Controllers as Lateral Movement Hubs: Exploiting Netlogon directly exposes the domain controller’s memory. See AD-28: Domain Controllers as lateral movement hubs.

4. Forensic Detection, Artefacts & Event IDs

DFIR analysts investigating CVE-2026-50500 should monitor Netlogon communication anomalies and LSASS stability:

Key Artefacts & Event IDs

System Event ID 1000 / Crash Reporting: Abnormal termination of lsass.exe with faulting module netlogon.dll and exception code 0xc0000005.
Directory Service Event ID 5827 / 5828: Netlogon secure channel connection rejection events due to cryptographic or session context failures.
Security Event ID 4624: High volume of Type 3 logons originating from a single workstation within short time frames.

KQL Query: Excessive Rapid Netlogon Connections

SecurityEvent
| where EventID == 4624
| where LogonProcessName =~ "Advapi" or LogonProcessName =~ "NtLmSsp"
| summarize AttemptCount = count(), UniqueIPs = dcount(IpAddress) by TargetUserName, IpAddress, bin(TimeGenerated, 5m)
| where AttemptCount > 50
| order by AttemptCount desc

5. Remediation, Hardening & Defensive Engineering

Apply Microsoft Patches: Install cumulative update July 2026 (KB5040442) across all Domain Controllers.
Enable RPC Over SMB Encryption: Enforce SMB signing and encryption to block man-in-the-middle packet manipulation.
Restrict Netlogon RPC Exposure: Isolate Domain Controllers so that only authorized management systems and branch subnets can establish direct MS-NRPC sessions.