NEGOEX CVE-2025-47981 Wormable 9.8: NC SMB Patch Plan July 2026

TL;DR: CVE-2025-47981 is a heap-based buffer overflow in the Windows SPNEGO Extended Negotiation (NEGOEX) security mechanism. CVSS 9.8. Network attack vector. No authentication required. No user interaction required. Microsoft describes it as fully wormable. It affects Windows client and server SKUs across the currently-supported estate. Every NC SMB that runs Windows-connected computers on any network — that is, every NC SMB — must complete same-week patching and this-week compensating controls. NEGOEX-class wormable RCEs are the specific vulnerability class that produced WannaCry, NotPetya, and BlueKeep. History does not need to repeat itself; you just need to patch.

Key takeaway: "Wormable" is Microsoft's own language and it has a specific meaning: the exploit needs neither credentials nor user interaction, so it can hop from one compromised host to another automatically. That is why WannaCry hit 200,000 hosts in 72 hours in 2017. NEGOEX belongs in the same threat class. Treat it that way.

Not sure if your Windows fleet is patched against CVE-2025-47981? Contact Preferred Data Corporation for a same-week patch-posture audit. BBB A+ rated. On-site within 200 miles of High Point. Call (336) 886-3282.

What Is CVE-2025-47981 and Why Does It Matter?

CVE-2025-47981 is a heap-based buffer overflow in the Windows implementation of SPNEGO Extended Negotiation (NEGOEX), the security-negotiation mechanism used by SMB, RPC, HTTP (Kerberos-over-HTTP), and various other Windows-authenticated protocols to select an authentication mechanism.

Three technical facts every NC SMB should internalize:

• CVSS 9.8 / AV:N / AC:L / PR:N / UI:N. Attack vector is network. Attack complexity is low. Privileges required is none. User interaction is none. This is the maximum-severity profile.
• Fully wormable. Microsoft's own description uses "wormable" language. That means the exploit is self-propagating: a compromised host can attack neighboring hosts without operator involvement.
• Broad affected surface. NEGOEX is implemented as part of the Windows security stack (SSPI). It ships in every supported Windows client and Windows Server SKU. There is no configuration that removes it. There is no Group Policy toggle that turns it off. There is only patching.

The CVSS score alone is not the whole story. WannaCry, in May 2017, was a wormable SMB flaw at CVSS 9.8 that hit an estimated 200,000 hosts in 150+ countries within 72 hours. Health services, logistics providers, manufacturers, and SMBs across NC absorbed most of the operational damage. NEGOEX has the same shape.

Key takeaway: Microsoft used the word "wormable." When Microsoft uses that word, drop everything else in the patch queue and put NEGOEX first.

Which Systems Are Affected in an NC SMB Fleet?

The affected surface is functionally every Windows system that participates in domain authentication or accepts inbound SMB, RPC, or Windows-authenticated HTTP.

The at-risk inventory for a typical NC SMB:

• All domain controllers. They handle inbound SMB and Kerberos and NEGOEX-mediated authentication all day, every day.
• All member servers. File servers, print servers, application servers, SQL Server hosts, Hyper-V hosts, ERP servers, backup servers.
• All Windows workstations. Windows 10 (ESU-supported through October 2028) and Windows 11 both ship the NEGOEX code.
• Windows Server Core installations. Server Core is not exempt. The vulnerability is in the security stack, not the GUI.
• Windows-based appliances. Backup appliances, printer/MFP embedded Windows firmware, and industrial-control HMIs that ship a Windows base image are all in scope.

One thing that is NOT affected: Linux hosts, macOS clients, and network appliances (Fortinet, Cisco IOS, Palo Alto) that do not run a Windows security stack. But Linux hosts that authenticate to Active Directory via Samba or SSSD can still be exploitation targets from — that is, an attacker who compromises a Linux authentication path can still use a Windows host to weaponize NEGOEX.

For NC manufacturers, the plant-floor Windows tablets, Windows-based HMIs, and Windows-embedded scanners that never see a patch cycle are the exact hosts a NEGOEX worm will fan out through. Take an inventory this week.

What Is the 72-Hour Patch Triage Plan for NC SMBs?

The right posture is triage: patch the highest-blast-radius hosts first while you finish the environment sweep on lower-risk hosts. Standing up compensating controls buys you the patch window.

Hour 0-24: Triage and compensating controls.

• Confirm the July 14, 2026 cumulative update is applied on all domain controllers. Cumulative updates ship monthly; this month's package contains the NEGOEX fix.
• Block inbound SMB (TCP 445), RPC endpoint mapper (TCP 135), and Windows-authenticated HTTP from the internet at the perimeter. Any exposed 445 or 135 today is a P0 remediation.
• Segment plant-floor VLANs from the corporate LAN with a stateful firewall rule set.
• Alert your MSSP / SOC on inbound SMB from any non-management IP.

Hour 24-72: Fleet patching.

• Push the July 14, 2026 cumulative update to all Windows servers and workstations via WSUS, Intune, ConnectWise Automate, N-able N-central, or whatever RMM tool you use.
• Force reboots inside a scheduled window. Delayed reboots do not close the vulnerability.
• Validate patch installation using SCCM/Intune compliance reporting or Get-HotFix PowerShell across the fleet.

Hour 72-168: Exception handling.

• Identify hosts that cannot patch this week — HMIs, appliances, legacy line-of-business hosts under vendor freeze.
• Apply strict network segmentation to those hosts: inbound SMB only from a named management host, no direct workstation-to-server SMB from user VLANs.
• Document the exception with owner, expected patch date, and compensating control.

The pattern above is not novel. It is the standard 72-hour cadence PDC has published in Patch Tuesday briefings for the last several years. What is novel is the specific CVE. NEGOEX is one you cannot afford to fold into normal monthly cadence.

Comparison: Wormable RCEs Every NC SMB Should Know About

Wormable RCEs are the rarest vulnerability class. When they appear, they define the following three years of exploitation. NEGOEX joins a short list.

The 2022 CVE-2022-37958 event is the direct precedent worth understanding. It was originally scored CVSS 8.1, then reclassified to 9.8 after IBM X-Force research showed the exploitation profile was much worse than initial analysis suggested. Every NC SMB that treated 2022's NEGOEX flaw as routine patching and skipped compensating controls learned late in the cycle that they had misjudged. Do not repeat that mistake with the 2026 flaw.

Which Compensating Controls Buy the Patch Window?

Patching is the fix. Compensating controls buy you the patch window and reduce blast radius while the fleet cycles through reboots.

Five compensating controls to enable this week:

• Perimeter block on SMB (TCP 445) and RPC endpoint mapper (TCP 135). No legitimate use case exposes these to the internet in an SMB environment. If you find them exposed today, close them today.
• Internal firewall segmentation. Plant-floor and OT VLANs should not be able to originate SMB traffic to corporate VLANs, and vice versa. This alone stops most wormable-RCE fan-out.
• SMB signing enforced on all servers and workstations. Group Policy path: Microsoft network server: Digitally sign communications (always). Enforce it via GPO on the domain root.
• SMBv1 disabled everywhere. SMBv1 is not the vulnerable protocol here, but SMBv1 hosts historically end up as vectors regardless. Turn it off. Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol.
• Endpoint detection and response (EDR) with NEGOEX-specific detection. Microsoft Defender for Endpoint, CrowdStrike Falcon, and SentinelOne have shipped detection logic for CVE-2025-47981 exploitation attempts. Confirm your EDR is on and reporting.

None of these are new. All should be baseline. The July 14, 2026 disclosure is a good excuse to confirm the baseline is actually in place.

What Should NC Manufacturers and Construction Firms Do Differently?

NC manufacturers and construction firms carry two structural risks that make NEGOEX exposure worse: plant-floor Windows devices that rarely patch, and jobsite laptops that connect to hostile Wi-Fi.

Manufacturers:

• Plant-floor HMIs, tablets, and Windows-embedded barcode scanners are frequently on a "we do not patch that" freeze because the vendor wants specific OS builds. Those are the hosts that will get worm-infected first.
• Segment plant-floor VLANs behind a firewall this week. Deny inbound SMB, RPC, and NEGOEX-authenticated HTTP from corporate. Explicitly permit only necessary MES / SCADA traffic.
• If the LOB app vendor blocks patching, invoke the vendor's exception process this week. NEGOEX exposure is a change of control on the LOB vendor's part.

Construction firms:

• Jobsite laptops that connect to public Wi-Fi at Starbucks or a general contractor's trailer are the exact hosts that get worm-attacked from a compromised peer on the same network.
• Enforce always-on VPN with per-endpoint firewalling. Endpoint firewall rules should deny inbound SMB from all networks except the corporate VPN subnet.
• Push patches via a cloud-managed RMM (Intune, N-able N-central) that works over the internet, not a WSUS server behind the office firewall.

PDC's Managed IT Services practice patches the fleet, segments the network, and stands up the EDR. Our Cybersecurity practice handles the exception workflow, MSSP feed, and the executive briefing. Our Manufacturing industry practice handles plant-floor vendor coordination.

What Signals Should MSSPs Watch for in NEGOEX Exploitation?

If NEGOEX exploitation begins in the wild — and every wormable-RCE pattern from the last decade says it will within 30-90 days — MSSPs and SOCs should watch specific telemetry signals.

Five NEGOEX exploitation indicators:

• Anomalous inbound SMB (TCP 445) traffic from newly-observed IPs. Especially internal-to-internal SMB from a workstation to servers where that path is not normal.
• Elevated LSASS crash frequency across the fleet. Wormable RCE PoCs frequently trigger LSASS crashes during exploit development.
• New Kerberos ticket-granting-service (TGS) requests from unusual service principal names. Post-exploitation lateral movement often uses newly-issued TGS.
• Windows Defender / Defender for Endpoint alerts tagged to NEGOEX or SPNEGO. Microsoft has shipped specific detection logic. Alert-to-close should be inside minutes, not hours.
• New services or scheduled tasks on servers unrelated to normal admin activity. Standard post-exploitation persistence.

If your MSSP is not watching for these, ask why. If you do not have an MSSP, PDC's managed-security stack includes these signals as standard.

Ready to lock down your Windows fleet against NEGOEX? Call PDC at (336) 886-3282 or request a same-week patch-posture audit. We audit the fleet, patch the gaps, stand up the compensating controls, and give you a signed patch-status report for insurance and compliance renewal.

Frequently Asked Questions

Is CVE-2025-47981 already being exploited in the wild?

At the time of the July 14, 2026 disclosure, Microsoft has not confirmed active exploitation. Historical patterns for wormable Windows RCEs show 30-90 day median time from disclosure to widespread exploitation. WannaCry hit 60 days after MS17-010. BlueKeep saw PoCs within weeks. Assume the exploit clock is running.

If we are on Windows Server 2016, do we get the fix?

Windows Server 2016 is currently in extended support through January 12, 2027. This month's cumulative update includes the fix. Once Windows Server 2016 exits support in January 2027, only ESU-enrolled customers receive fixes for future CVEs. See our Windows Server 2016 migration playbook for the migration path.

Does disabling NEGOEX close the vulnerability?

NEGOEX cannot be cleanly disabled without breaking Kerberos and NTLM negotiation on modern Windows. The patch is the fix. Compensating controls (network segmentation, SMB signing, EDR) reduce blast radius while patches deploy.

What about our Windows 10 workstations?

Windows 10 is in ESU as of October 2025. ESU-enrolled Windows 10 receives the July 14, 2026 cumulative update including the NEGOEX fix. Non-ESU Windows 10 does not. That is one more reason to accelerate the Windows 10 to Windows 11 refresh.

How does our cyber insurance react to unpatched NEGOEX?

Cyber-insurance carriers increasingly audit patch cadence at renewal, particularly for critical/high CVEs and KEV-listed vulnerabilities. Documented 14-day patching for critical CVEs is now table stakes. Unpatched NEGOEX at 90 days is a documented exception on your next renewal questionnaire and a common trigger for premium increases.

What if we cannot patch a specific plant-floor host?

Document the exception. Segment the host behind a stateful firewall that denies inbound SMB, RPC, and NEGOEX-authenticated HTTP from all networks except a named management host. Add EDR coverage. Renew the exception every 30 days. Get the vendor commitment in writing to certify against the patched OS build.

Related Resources

• Managed IT Services
• Cybersecurity Services
• Windows Server 2016 EOL migration playbook
• Manufacturing Industry Services
• Contact PDC — same-week patch-posture audit