tenable:241550 · KB5062572: Windows Server 2022 / Azure Stack HCI 22H2 Security…

01 · The Real Story

Someone left the front gate unlocked and every room inside is connected by open hallways

KB5062572 is a cumulative rollup for Windows Server 2022 and Azure Stack HCI 22H2 (OS Build 20348.3932) released July 8, 2025, addressing 82 security vulnerabilities across 6 Critical, ~75 Important, and 1 Moderate flaws. The headline CVE is CVE-2025-47981 — a heap-based buffer overflow (CWE-122) in the SPNEGO Extended Negotiation (NEGOEX) protocol, the handshake layer Windows uses to negotiate authentication *before* any credentials are exchanged. CVSS 9.8, pre-auth, network-reachable, zero user interaction, and explicitly assessed by Microsoft as wormable. Affected: every supported Windows client (10 1607+, 11 22H2+) and every Windows Server build (2016, 2019, 2022, 2025) — the entire modern Windows fleet. Additional critical CVEs in this rollup include CVE-2025-48822 (Hyper-V DDA out-of-bounds read RCE, CVSS 8.6) and CVE-2025-49735 (Kerberos KDC Proxy Service RCE, CVSS 8.1). The update also hardens the Netlogon RPC protocol to block anonymous client calls on domain controllers.

The stated 'MEDIUM' vendor severity is flatly wrong as a characterization of this rollup. The lead CVE carries a vendor-assigned CVSS of 9.8 CRITICAL. Tenable's plugin severity of HIGH (CVSS base 7.8, VPR 8.9 at the 99.7th percentile) is a composite score across all CVEs in the rollup, which mathematically dilutes the SPNEGO flaw. But a cumulative update is only as safe as its worst unfixed CVE — and CVE-2025-47981 is a pre-auth wormable RCE against the authentication negotiation layer of every Windows host. Microsoft explicitly rates exploitation as 'more likely.' Any severity label below CRITICAL for this rollup is a miscategorization that will cause defenders to deprioritize a patch that protects against fleet-scale compromise.

"Wormable pre-auth RCE in Windows auth negotiation — this is the next EternalBlue-class threat"

02 · The Attack Path

5 steps from start to impact.

STEP 01

Network reachability to SPNEGO-speaking service

The attacker identifies a Windows host exposing any service that performs SPNEGO negotiation: SMB (TCP 445), RDP (TCP 3389), HTTP/S with Windows Authentication (TCP 80/443), LDAP (TCP 389/636), or WinRM (TCP 5985/5986). On domain controllers, ports 445 and 389 are required to be reachable by all domain members — they cannot be firewalled without breaking AD. On file servers, SMB is the entire point. This is not a niche exposure.

Conditions required:

Target host runs unpatched Windows Server 2022 (build < 20348.3932)
At least one SPNEGO-speaking port is network-reachable from the attacker's position

Where this breaks in practice:

Perimeter firewalls block 445/389 from the internet in most enterprises, limiting external exploitation
Internal network segmentation (micro-seg, VLANs) limits lateral blast radius post-initial-access

Detection/coverage: Qualys QID 92618, Nessus 241550, Microsoft Defender Vulnerability Management flag for KB5062572. Network IDS signatures for anomalous NEGOEX message sizes are emerging but not yet in mainstream rulesets.

STEP 02

Send crafted NEGOEX authentication message

The attacker sends a specially crafted NEGOEX message with an oversized or malformed field during the authentication negotiation phase — *before* any credentials are validated. The NEGOEX parser on the target allocates a heap buffer based on attacker-controlled size fields but fails to validate bounds, causing a heap-based buffer overflow (CWE-122). No username, no password, no prior session — this fires during the protocol handshake itself.

Conditions required:

Ability to send raw TCP packets to the target service
No network-level deep packet inspection blocking malformed NEGOEX payloads

Where this breaks in practice:

Heap layout must be groomed for reliable exploitation — not trivial but achievable with known heap spray techniques on Windows
ASLR and CFG provide some mitigation, though heap overflows in kernel-adjacent code have historically bypassed these

Detection/coverage: EDR telemetry for anomalous lsass.exe or negoexts.dll crash events. Windows Event Log entries for SPNEGO/NEGOEX failures. SOC Prime has published Sigma rule stubs for NEGOEX anomalous authentication patterns.

STEP 03

Heap corruption → arbitrary code execution

The overflow overwrites adjacent heap metadata or function pointers in the NEGOEX processing context. Because this code runs in the context of the Local System account (via lsass.exe or the service hosting SPNEGO), successful exploitation grants SYSTEM-level code execution on the target host. There is no privilege escalation step — the attacker lands at maximum privilege immediately.

Conditions required:

Successful heap grooming to place controllable data adjacent to the overflow target
Target has not applied KB5062572 or equivalent cumulative update

Where this breaks in practice:

Windows Exploit Guard / Hardware-enforced Stack Protection on newer builds may complicate ROP chains
Exploit reliability varies across OS builds due to heap allocator differences

Detection/coverage: CrowdStrike Falcon, Microsoft Defender for Endpoint, and SentinelOne should detect anomalous lsass.exe behavior post-exploitation. Pre-exploitation detection depends on network-level NEGOEX inspection.

STEP 04

Lateral movement — wormable propagation

With SYSTEM on one host, the attacker (or automated payload) enumerates adjacent hosts on the same network segment and repeats steps 1-3 against each one. Because SMB port 445 is typically open between Windows hosts in an AD environment for file sharing and Group Policy, the worm can propagate laterally without any additional credentials or tools. This is the same propagation model as EternalBlue/WannaCry (MS17-010).

Conditions required:

Flat or poorly segmented internal network
Adjacent hosts also unpatched

Where this breaks in practice:

Network micro-segmentation limits propagation scope
Host-based firewalls blocking inbound 445 from non-DC sources would contain spread
Rapid patching of the fleet reduces the wormable surface

Detection/coverage: GreyNoise and network flow analysis for sudden spike in internal SMB connection attempts. SIEM correlation rule: single host initiating 445 connections to >10 peers in <60 seconds.

STEP 05

Domain controller compromise → full AD takeover

If any domain controller in the environment is unpatched, the worm reaches it via the mandatory LDAP/SMB ports. SYSTEM on a DC means the attacker can run DCSync, extract the krbtgt hash, forge Golden Tickets, and achieve persistent domain-wide compromise. For Azure Stack HCI nodes, SYSTEM access means control of the hyperconverged cluster — all guest VMs, storage, and network configuration.

Conditions required:

At least one domain controller or Azure Stack HCI node is unpatched
DC ports 389/445 are reachable from compromised host (required for AD to function)

Where this breaks in practice:

Organizations running Tier 0 isolation for DCs with dedicated PAWs and jump servers may limit initial access to the DC subnet
Credential Guard on DCs hardens post-exploitation credential theft

Detection/coverage: DCSync detection (Replication-Get-Changes-All audit events, Event ID 4662). Anomalous service account logons on DCs. Azure Stack HCI health service alerts for unexpected cluster membership changes.

03 · Compensating Control

CRITICAL 9.8→HIGH 7.5

SEVERITY REDUCED

Apply KB5062572 to all domain controllers within 72 hours — Domain controllers are the highest-value targets for this wormable pre-auth RCE. SYSTEM on a DC is game over for the entire AD domain. Per the noisgate mitigation SLA for CRITICAL, deploy within 3 days. Use WSUS, SCCM/MECM, or Intune to push KB5062572 (OS Build 20348.3932) to all Server 2022 DCs immediately. Schedule a maintenance window; this is a restart-required update. Prioritize DCs over all other hosts.

CRITICAL 9.8→HIGH 7.0

SEVERITY REDUCED

Apply KB5062572 to Azure Stack HCI nodes and Hyper-V hosts within 72 hours — HCI nodes and Hyper-V hosts are second-priority targets. SYSTEM on these hosts compromises all guest VMs and storage. Per the noisgate mitigation SLA for CRITICAL, deploy within 3 days. Use Cluster-Aware Updating (CAU) for HCI clusters to patch with minimal downtime. Hyper-V hosts should be live-migrated and patched in rolling fashion.

CRITICAL 9.8→HIGH 8.0

SEVERITY REDUCED

Disable 'Network security: Allow PKU2U authentication requests' via GPO — This Group Policy setting is enabled by default on Windows 10 1607+ and controls whether the PKU2U security support provider (SSP) is loaded, which is part of the NEGOEX attack surface. Disabling it via

Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options → Network security: Allow PKU2U authentication requests to this computer to use online identities → Disabled

reduces the NEGOEX negotiation surface. This is a temporary compensating control while patching proceeds — it does not fully eliminate the SPNEGO/NEGOEX attack vector, as Kerberos and NTLM negotiation still uses SPNEGO.

CRITICAL 9.8→HIGH 7.5

SEVERITY REDUCED

Block inbound ports 135, 445, 5985 at internal segment boundaries — Use network firewalls or micro-segmentation (e.g., VMware NSX, Illumio, Zscaler ZPA) to restrict SMB (445), RPC (135), and WinRM (5985) traffic to only authorized source/destination pairs. This limits the wormable propagation radius. On DCs, allow 445/389 only from known domain member subnets, not from user workstation VLANs directly. This does NOT eliminate the vulnerability but constrains lateral movement.

CRITICAL 9.8→HIGH 8.5

SEVERITY REDUCED

Enable Windows Exploit Guard and Hardware-enforced Stack Protection — On Windows Server 2022, enable Exploit Protection policies (especially heap integrity checks, ASLR enforcement, and CFG) via Set-ProcessMitigation. Hardware-enforced Stack Protection (Shadow Stacks via CET on supported CPUs) makes heap overflow exploitation significantly harder. This is a defense-in-depth measure — it raises the exploitation bar but does not patch the underlying vulnerability.

CRITICAL 9.8→CRITICAL 9.0

Deploy network-level NEGOEX anomaly detection — Configure IDS/IPS rules to flag anomalously large or malformed NEGOEX authentication messages on ports 445, 389, 3389, and 5985. SOC Prime has published Sigma rule stubs for NEGOEX anomalies. Deploy Suricata or Snort rules to inspect SMB negotiation payloads for oversized NEGOEX tokens. This provides detection but not prevention against a motivated attacker.

What doesn't work

MFA / Conditional Access — This vulnerability fires during protocol negotiation *before* any authentication occurs. MFA protects the authentication step; the overflow happens in the handshake that precedes it. MFA is irrelevant here.
Credential Guard / Windows Defender Credential Guard — Protects credentials post-authentication (LSASS isolation). Does not prevent the initial heap overflow exploitation that grants SYSTEM access. Useful for limiting post-exploitation credential theft but does not mitigate the RCE itself.
Application-layer WAF — WAFs inspect HTTP/HTTPS payloads but SPNEGO/NEGOEX negotiation occurs at the protocol handshake level, often embedded in SMB or LDAP — protocols WAFs do not inspect. A WAF in front of IIS with Negotiate auth *might* see the HTTP-level SPNEGO token, but this is not reliable protection.
Disabling SMBv1 only — SMBv1 deprecation is good hygiene but irrelevant. CVE-2025-47981 affects the SPNEGO/NEGOEX layer which is used by SMBv2/v3, LDAP, RDP, and HTTP Negotiate. Disabling SMBv1 does not remove the attack surface.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Status	No confirmed active exploitation as of October 2026. Not in CISA KEV. Microsoft assessed exploitation as 'more likely' at disclosure. The wormable pre-auth nature makes this a high-priority target for weaponization.
Proof-of-Concept	2 public GitHub repositories reference CVE-2025-47981. The primary repo (HKenzoKimura/CVE-2025-47981, created Sept 2026) is a PowerShell assessment/detection script — it checks OS version, `ntoskrnl.exe` build, PKU2U registry state, and listening ports. It is explicitly not a weaponized exploit. No functional RCE PoC has been publicly released.
EPSS	41% probability of exploitation in the next 30 days, 98th percentile. This is an exceptionally high EPSS score, placing CVE-2025-47981 in the top 2% of all CVEs for predicted exploitation likelihood.
CISA KEV	Not listed in the CISA Known Exploited Vulnerabilities catalog as of October 2026.
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` — 9.8 Critical. Every base metric is at maximum severity: network-reachable, low complexity, no privileges, no user interaction, full CIA impact. The temporal score with `E:U/RL:O/RC:C` adjusts slightly for unproven exploitation and official remediation available.
Affected Versions	Windows Server 2022 (all builds prior to 20348.3932), Windows Server 2025, 2019, 2016. Windows 10 1607+, Windows 11 22H2+. Both Server Core and Desktop Experience. x64, x86, and ARM64 architectures.
Fixed Version	Windows Server 2022: OS Build 20348.3932 via KB5062572. Also fixed in KB5062552 (Server 2019), KB5062557 (Server 2016), KB5062560 (Win10 22H2), KB5062570 (Win11 23H2), KB5062592 (Win11 24H2), KB5062619 (Server 2025).
Exposure Data	SPNEGO/NEGOEX is enabled by default on every Windows installation. Shodan shows millions of hosts with SMB (445) and RDP (3389) exposed to the internet. Internally, port 445 is open between virtually all Windows domain members. The PKU2U GPO ('Allow PKU2U authentication requests') is enabled by default on Windows 10 1607+.
Disclosure & Attribution	Disclosed July 8, 2025 (Patch Tuesday). Discovered by Yuki Chen of Cyber KunLun (Kunlun Lab) alongside anonymous contributors, via coordinated disclosure. Yuki Chen also disclosed the related CVE-2025-21295 (NEGOEX SPNEGO flaw) in January 2025.
VPR / Plugin Severity	Tenable VPR: 8.9 (99.7th percentile, HIGH). Tenable plugin 241550 composite CVSS base: 7.8 (HIGH). The VPR score correctly reflects near-critical risk; the plugin base score is diluted by averaging across 82+ CVEs in the rollup.

Sources.

05 · The Call

Final Verdict

↑ UPGRADED to CRITICAL (9.8/10)

Why this verdict

Pre-auth wormable RCE with zero friction prerequisites: CVE-2025-47981 requires no credentials, no user interaction, and no special configuration. The attack fires during the SPNEGO/NEGOEX handshake — the protocol negotiation that happens *before* authentication even begins. Every Windows service that accepts Windows Authentication is a valid target. This is the lowest-friction attack vector possible on Windows.
Universal attack surface with no opt-out: SPNEGO/NEGOEX is compiled into every Windows OS. SMB (445), RDP (3389), LDAP (389), HTTP with Negotiate auth, and WinRM all use it. On domain controllers, ports 445 and 389 *must* be open to all domain members for AD to function. There is no configuration that turns NEGOEX off without breaking core Windows functionality.
EPSS 41% / 98th percentile with 'more likely' exploitation assessment: Microsoft's own exploitability index rates this as 'Exploitation More Likely.' The EPSS model assigns a 41% probability of exploitation in 30 days — among the highest scores ever assigned. The absence of a weaponized public PoC is a temporary condition, not a durable mitigant.
Role multiplier — Domain Controllers: Windows Server 2022 is the current-generation DC OS. Domain controllers *must* expose SMB/LDAP to all domain members. Pre-auth SYSTEM-level RCE on a DC → DCSync → krbtgt extraction → Golden Ticket → complete Active Directory domain takeover. DCs represent ≥15% of Windows Server 2022 deployments in enterprise. The blast radius is domain-scale (every identity, every host, every GPO). This alone sets a CRITICAL floor.
Role multiplier — Azure Stack HCI nodes: KB5062572 explicitly covers Azure Stack HCI 22H2. These are hyperconverged infrastructure nodes running Hyper-V, Storage Spaces Direct, and SDN. SYSTEM on an HCI node means control of all guest VMs, cluster storage, and network fabric. Blast radius: fleet-scale for any workloads hosted on the cluster.
Role multiplier — Hyper-V hosts: CVE-2025-48822 (Hyper-V DDA OOB read, CVSS 8.6) is *also* in this rollup. An unpatched Windows Server 2022 Hyper-V host is vulnerable to both the SPNEGO wormable RCE *and* a hypervisor boundary escape. Combined blast radius: host compromise + guest VM compromise.
Wormable propagation model matches EternalBlue (MS17-010): The same lateral propagation characteristics that enabled WannaCry and NotPetya apply here: pre-auth RCE over SMB port 445, no credentials needed, automatic propagation. In flat enterprise networks, a single compromised host can reach the entire Windows fleet.

Why not higher?

CVSS 9.8 is already near-maximum. The only reason this is not a perfect 10.0 is that the Scope metric is Unchanged (S:U) — exploitation does not cross a security boundary in the CVSS model's definition (though in practice, DC compromise crosses every logical boundary in the enterprise). There is no higher severity bucket than CRITICAL.

Why not lower?

Downgrading below CRITICAL would require evidence that the attack surface is meaningfully restricted in real deployments. It is not. SPNEGO/NEGOEX is on by default, SMB 445 is open internally in every AD environment, domain controllers cannot firewall it off, and the flaw is pre-auth with no user interaction. The 41% EPSS score, 'more likely' Microsoft assessment, and the wormable classification all confirm this is a top-tier threat. The absence of a public weaponized PoC is the *only* friction point, and history shows that CVSS 9.8 pre-auth Windows flaws are weaponized within weeks to months of disclosure. Every role in the Windows Server 2022 deployment spectrum — DC, Hyper-V host, HCI node, file server, application server — has catastrophic consequences on exploitation.

06 · Verification

Crowdsourced verification payload.

Run this script on each target Windows Server 2022 host (locally or via remote PowerShell). Requires administrator privileges to read OS build info and hotfix history. Invoke: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2025-47981.ps1

noisgate-verify.ps1

POWERSHELLREAD-ONLYSAFE

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Checks whether the local Windows Server 2022 / Azure Stack HCI 22H2 host
    is vulnerable to CVE-2025-47981 (SPNEGO NEGOEX heap overflow) by verifying
    KB5062572 installation and OS build number.
.NOTES
    Output: VULNERABLE / PATCHED / UNKNOWN
    Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'

try {
    $os = Get-CimInstance Win32_OperatingSystem
    $build = [System.Version]$os.Version
    $caption = $os.Caption

    Write-Host "[*] Host: $($env:COMPUTERNAME)"
    Write-Host "[*] OS:   $caption"
    Write-Host "[*] Build: $($os.Version)"

    # Check if this is Windows Server 2022 (build 20348.x)
    if ($build.Major -ne 10 -or $build.Build -ne 20348) {
        Write-Host "[?] This host is not Windows Server 2022 (build 20348.x)."
        Write-Host "[?] If running another affected OS, check the appropriate KB."
        Write-Host "UNKNOWN"
        exit 2
    }

    # Fixed build: 20348.3932 (KB5062572, July 2025)
    $fixedRevision = 3932
    $currentRevision = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name UBR).UBR

    Write-Host "[*] Current UBR (Update Build Revision): $currentRevision"
    Write-Host "[*] Fixed UBR:  $fixedRevision (KB5062572)"

    # Also check for the KB directly
    $kb = Get-HotFix -Id 'KB5062572' -ErrorAction SilentlyContinue

    # Check PKU2U GPO status (additional context)
    $pku2uPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\pku2u'
    $pku2uEnabled = $null
    if (Test-Path $pku2uPath) {
        $pku2uVal = Get-ItemProperty $pku2uPath -Name 'AllowOnlineID' -ErrorAction SilentlyContinue
        if ($null -ne $pku2uVal) {
            $pku2uEnabled = $pku2uVal.AllowOnlineID -eq 1
        }
    }
    if ($null -ne $pku2uEnabled) {
        Write-Host "[*] PKU2U AllowOnlineID: $(if ($pku2uEnabled) {'ENABLED (higher risk)'} else {'DISABLED (reduced surface)'})"
    } else {
        Write-Host "[*] PKU2U AllowOnlineID: DEFAULT (enabled on Win10 1607+)"
    }

    # Verdict
    if ($currentRevision -ge $fixedRevision) {
        Write-Host "`n[+] OS build revision $currentRevision >= $fixedRevision"
        if ($kb) { Write-Host "[+] KB5062572 confirmed installed: $($kb.InstalledOn)" }
        Write-Host "PATCHED"
        exit 0
    } else {
        Write-Host "`n[-] OS build revision $currentRevision < $fixedRevision"
        Write-Host "[-] KB5062572 is NOT installed."
        Write-Host "[-] This host is vulnerable to CVE-2025-47981 (SPNEGO NEGOEX wormable RCE)."
        Write-Host "VULNERABLE"
        exit 1
    }
} catch {
    Write-Host "[!] Error during check: $_"
    Write-Host "UNKNOWN"
    exit 2
}