Cloud Security

Netlogon CVE-2026-41089: Patch Your Domain Controllers Now

June 25, 2026 · 7 min read · By CloudAI Security

CVE-2026-41089 is a critical CVSS 9.8 stack-based buffer overflow in the Windows Netlogon service that lets an unauthenticated, network-reachable attacker execute arbitrary code as SYSTEM on any supported Windows domain controller, from Server 2012 through Server 2025. Belgium’s national CSIRT, the Centre for Cybersecurity Belgium (CCB), has confirmed active in-the-wild exploitation since late May 2026. The fix shipped in Microsoft’s May 2026 Patch Tuesday cumulative update — patch every domain controller immediately, before weaponization scales.

A Zerologon-Grade Flaw Returns

Six years after Zerologon (CVE-2020-1472) taught the industry that the Netlogon service is the soft underbelly of Active Directory, history is repeating itself. A new stack-based buffer overflow in the same service — tracked as CVE-2026-41089, rated CVSS 9.8 — lets an unauthenticated attacker execute arbitrary code on any supported Windows domain controller over the network. The Centre for Cybersecurity Belgium (CCB), the country’s national CSIRT, issued an urgent advisory on 29 May 2026 confirming active in-the-wild exploitation. If you run Active Directory, this is the one patch this month that overrides your change freeze.

The parallels to Zerologon are not cosmetic. Both target the Remote Procedure Call (RPC) interface that authenticates users and machines against the domain. Both require no credentials to trigger. Both end in total domain compromise when they land on a domain controller. The difference is the mechanism: CVE-2020-1472 was a cryptographic downgrade, while CVE-2026-41089 is a classical stack buffer overflow (CWE-121) triggered by a single malformed request. For a refresher on why hardened identity infrastructure keeps biting defenders, see our earlier analysis of Okta’s 52-character authentication bug.

How the Exploit Works

Netlogon is the core authentication protocol between domain controllers and member servers, and it runs on every Windows domain-joined machine. CVE-2026-41089 lives in how that service parses incoming RPC requests. An attacker who can reach a domain controller over the network — typically over TCP port 445 and the dynamic RPC port range — sends a specially crafted request that overflows a stack buffer inside the Netlogon service.

The overflow is exploitable with low complexity and zero privileges. According to Microsoft’s advisory, a successful request “could cause the Netlogon service to improperly handle the request, potentially allowing the attacker to run code on the affected system without needing to sign in or have prior access,” as reported by Logicity. Code executes in the context of the Netlogon service — effectively SYSTEM on a domain controller. From there, the attacker can mint domain administrator accounts, dump NTDS.dit credential hashes, deploy ransomware, and traverse every domain-joined system. The full CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, per the technical breakdown at SecurityVulnerability.io.

Every Supported Server Is Exposed

The blast radius is the entire Windows Server estate. Every currently supported release is vulnerable, including Windows Server 2025. The flaw was patched in the May 2026 Patch Tuesday release on 12 May 2026, but any server that has not taken that cumulative update remains open. Microsoft’s internal Windows Attack Research & Protection (WARP) team discovered and reported the vulnerability before disclosure, according to BleepingComputer’s reporting.

Domain controllers are the priority targets, but they are not the only ones. Because Netlogon runs on every domain-joined server, any unpatched member server reachable on the network is a potential foothold. Branch-office domain controllers, read-only DCs in the DMZ, and forgotten virtualization hosts are the systems most likely to slip through a patch cycle — and the ones attackers will hunt for first. Inventory discipline matters here as much as the patch itself.

Active Exploitation Is Confirmed

The signal that elevates this from “patch on schedule” to “patch tonight” came from Belgium. The CCB updated its May Patch Tuesday advisory on 29 May 2026 to state plainly that CVE-2026-41089 “is now actively exploited in the wild,” urging organisations to patch as quickly as possible. The advisory did not publish attack details or indicators of compromise, but a national CSIRT putting out a dedicated exploitation warning is a high-confidence indicator of real, ongoing threat activity.

As of publication, Microsoft had not updated its own advisory to confirm in-the-wild exploitation, and did not respond to press requests for comment. That gap matters less than it usually would. The vulnerability’s profile — network-reachable, no authentication, no user interaction, CVSS 9.8 — makes it an ideal candidate for automated scanning and mass exploitation the moment a public PoC appears. Defenders should assume weaponization is imminent if it has not already happened silently.

Patch Builds and Priority Order

Microsoft shipped the fix in the May 2026 cumulative update. The remediation is straightforward: apply the latest cumulative update to reach or exceed the minimum build numbers below. Domain controllers go first, then externally accessible servers, then the remainder of the estate. The official source is the Microsoft Security Response Center advisory.

Windows Server version	Fixed build (minimum)
Server 2016	10.0.14393.9140
Server 2019	10.0.17763.8755
Server 2022	10.0.20348.5074
Server 2022 23H2	10.0.25398.2330
Server 2025	10.0.26100.32772

If an emergency patch window is politically impossible, the only meaningful compensating control is network segmentation: restrict inbound access to domain controllers so that only known management subnets and legitimate domain members can reach TCP 445 and the RPC endpoint mapper range. That shrinks the attack surface but does not eliminate it — any compromised member server becomes a launch point. For cloud-hosted domain controllers, verify that Network Security Groups are not exposing these ports to the public internet. The recurring lesson that internet-facing infrastructure is the breach entry point is reinforced in our coverage of the Check Point VPN zero-day feeding Qilin ransomware.

Detection and Network Containment

Patching is necessary but not sufficient. Once exploitation is public, defenders need to know whether they were already hit. Focus detection on the Netlogon service and its surrounding authentication traffic. Monitor Windows Security event logs and Netlogon service logs for anomalous authentication patterns, unexpected service restarts, or crashes that precede a successful overflow. On the network side, watch for unexpected RPC requests targeting domain controllers — particularly from non-member hosts, scanning patterns across TCP 445, or connections outside approved management ranges.

Indicators of a successful foothold include the sudden creation of new domain administrator accounts, anomalous DCSync or NTDS.dit access activity, and LSASS credential access from unexpected processes. If any of these appear on an unpatched domain controller, treat it as a domain-compromise incident: assume the attacker owns the directory, rotate the krbtgt account password twice, force-reset privileged credentials, and rebuild the affected controller from a known-good image rather than cleaning in place.

The Nightmare Eclipse Backdrop

CVE-2026-41089 did not arrive in isolation. It is part of a broader wave of Windows security flaws disclosed by an anonymous researcher operating under the name “Nightmare Eclipse.” Recent disclosures in the same campaign include YellowKey (CVE-2026-45585), a BitLocker bypass granting access to protected drives; BlueHammer (CVE-2026-33825) and RedSun (CVE-2026-41091), both privilege escalation bugs under active exploitation; and UnDefend (CVE-2026-45498), which lets a standard user disable Microsoft Defender, per Logicity’s summary.

The takeaway for security operations is that the Windows attack surface is being methodically mined and weaponized in parallel. A single critical Netlogon RCE is dangerous on its own; chained with a Defender-disabling primitive or a BitLocker bypass, it becomes a full-impact ransomware delivery pipeline. Track the entire Nightmare Eclipse series, not just the headline CVE, because defenders patching in isolation will lose the chained-attack race.