CVE-2026-41089: Critical Windows Netlogon RCE Under Active Exploit

A critical remote code execution vulnerability in Windows Netlogon is now under active exploitation in the wild. The flaw, tracked as CVE-2026-41089, carries a CVSS score of 9.8 and allows unauthenticated attackers to execute code on Windows domain controllers. Belgium’s national cybersecurity authority confirmed the active exploitation and urged immediate patching.

What Happened: Critical Windows Netlogon RCE Now Exploited in Attacks

Microsoft patched CVE-2026-41089 during the May 2026 Patch Tuesday cycle on May 12, 2026. The vulnerability is a stack-based buffer overflow in the Windows Netlogon service. Consequently, attackers without any privileges can gain remote code execution on targeted domain controllers by sending specially crafted network requests.

The Centre for Cybersecurity Belgium (CCB), the country’s national authority for cybersecurity, warned on May 30, 2026, that threat actors are actively exploiting this vulnerability in the wild. The CCB specifically urged administrators to patch vulnerable servers as quickly as possible. However, the CCB did not provide further details on the ongoing attacks. Microsoft has not yet updated its advisory to confirm the active exploitation.

Technical Details of the Windows Netlogon Vulnerability

Netlogon is a remote procedure call (RPC) interface and a core Microsoft Windows Server background service. It authenticates services and users on Windows domain-based networks. Therefore, a vulnerability in this component poses a severe risk to enterprise infrastructure.

According to Microsoft’s security advisory, an attacker could send a specially crafted network request to a Windows server acting as a domain controller. If successful, this improper handling could allow the attacker to run code on the affected system without signing in or having prior access. Furthermore, the vulnerability impacts all currently supported Windows Server versions, including the latest release, Windows Server 2025.

• CVE ID: CVE-2026-41089
• CVSS Score: 9.8 (Critical)
• Component: Windows Netlogon RPC service
• Attack Vector: Network-based, unauthenticated
• Impact: Remote code execution on domain controllers
• Affected Versions: All supported Windows Server versions, including Windows Server 2025
• Patch Date: May 12, 2026 (Patch Tuesday)
• Discovery: Microsoft WARP (Windows Attack Research & Protection) team

Business and Operational Impact

The exploitation of CVE-2026-41089 carries severe consequences for organizations running Windows domain controllers. A successful attack grants the attacker full control over the domain controller, which is the central authentication hub for the entire Active Directory environment.

• Domain compromise: Attackers can create new user accounts, modify permissions, and establish persistent access across the entire network.
• Lateral movement: Compromised domain controllers enable threat actors to move laterally to other systems, including sensitive file servers and databases.
• Credential theft: Attackers can extract password hashes and Kerberos tickets for all domain users, enabling further compromise.
• Service disruption: Malicious actors could disrupt authentication services, preventing legitimate users from accessing resources.
• Compliance violations: A domain controller breach may trigger reporting obligations under GDPR, HIPAA, PCI-DSS, and other regulatory frameworks.

Mitigation and Recommendations

Organizations must act immediately to protect their Windows domain controllers from CVE-2026-41089 exploitation. The following steps provide a clear path to reducing exposure and improving detection capabilities.

Immediate Actions for Defenders

1. Apply the May 2026 Patch Tuesday updates immediately. Microsoft released the fix for CVE-2026-41089 on May 12, 2026. All supported Windows Server versions require the relevant security update.
2. Prioritize patching domain controllers. These systems are the primary targets and the most critical infrastructure components to protect.
3. Verify patch installation. Use Windows Update history or the System Center Configuration Manager to confirm patches have been successfully applied across all domain controllers.
4. Monitor Netlogon traffic for anomalies. Increase logging on domain controllers and watch for unusual authentication requests or RPC activity from unexpected sources.
5. Deploy network segmentation. Isolate domain controllers from untrusted networks where possible to reduce the attack surface.

Detection and Monitoring Guidance

Security teams should review domain controller event logs for indicators of compromise. Furthermore, organizations should ensure that endpoint detection and response (EDR) solutions are configured to alert on suspicious processes spawned by the Netlogon service. Network monitoring tools can also identify anomalous RPC traffic directed at domain controllers from unexpected IP ranges.

Long-Term Hardening

In addition to immediate patching, organizations should evaluate their broader domain controller security posture. Moreover, implementing the principle of least privilege and regularly auditing privileged access reduces the blast radius of future vulnerabilities. Security teams should also establish an emergency patch process for critical vulnerabilities with confirmed active exploitation.

Bottom line: CVE-2026-41089 is a critical, actively exploited vulnerability affecting all supported Windows Server versions. Organizations must patch their domain controllers immediately, monitor for signs of compromise, and harden their Active Directory infrastructure to prevent future attacks.

Incident Summary

CVE ID / Incident:	CVE-2026-41089 — Windows Netlogon Remote Code Execution
Affected Systems:	All supported Windows Server versions, including Windows Server 2025
Disclosure Date:	May 12, 2026 (patched); May 30, 2026 (active exploitation confirmed)
Patch Status:	Available via May 2026 Patch Tuesday
Severity:	CVSS 9.8 (Critical)
Attack Vector:	Network-based, unauthenticated
Exploitation Status:	Actively exploited in the wild
Discovery:	Microsoft WARP (Windows Attack Research & Protection)

References

1. Microsoft Security Response Center, “CVE-2026-41089,” Microsoft Update Guide, May 12, 2026, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089, accessed June 2, 2026.
2. Centre for Cybersecurity Belgium (CCB), “Warning: Microsoft Patch Tuesday May 2026,” CCB Security Advisory, May 30, 2026, https://ccb.belgium.be/advisories/warning-microsoft-patch-tuesday-may-2026-patches-118-vulnerabilities-16-critical-102, accessed June 2, 2026.
3. Sergiu Gatlan, “Critical Windows Netlogon RCE flaw now exploited in attacks,” BleepingComputer, June 1, 2026, https://www.bleepingcomputer.com/news/microsoft/critical-windows-netlogon-remote-code-execution-flaw-now-exploited-in-attacks/, accessed June 2, 2026.
4. Microsoft, “Netlogon Remote Protocol,” Microsoft Open Specifications, https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/ff8f970f-3e37-40f7-bd4b-af7336e4792f, accessed June 2, 2026.