ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Organization

Centre for Cybersecurity Belgium

0 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

2026-007: Critical Vulnerability in Windows Netlogon

Actively exploited CVSS 9.8 Windows Netlogon flaw lets unauthenticated attackers execute code with SYSTEM privileges on domain controllers.

Microsoft's May 2026 advisory describes CVE-2026-41089, a stack-based buffer overflow in Windows Netlogon (CVSS 9.8) that allows unauthenticated remote code execution with SYSTEM privileges on domain controllers via specially crafted packets. The Centre for Cybersecurity Belgium reports the flaw is currently being exploited by threat actors. All Windows Server versions from 2012 through 2025 acting as domain controllers are affected and require the May updates.

CERT-EU Advisories · 7d agoExploit / PoC in the wildCVE-2026-410891

Related CVEs

  • CVE-2026-410899.880%
    Unauthenticated Stack Buffer Overflow RCE in Windows Server Netlogon (CVE-2026-41089)
    CVE-2026-41089 is a stack-based buffer overflow (CWE-121) in the Netlogon service of Windows Server. An unauthenticated remote attacker can trigger it by sending crafted network requests to the Netlogon RPC interface, with no privileges or user interaction required per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields remote code execution with high confidentiality, integrity, and availability impact; on domain controllers, where Netlogon runs by default, this typically means compromise of a critical authentication server and risk of broader domain compromise. All organizations running the affected Windows Server versions (2012, 2016, 2019, 2022, 2022 23H2, and 2025) are in scope, with Active Directory domain controllers the highest-value targets. Microsoft fixed the flaw in its May 2026 Patch Tuesday release (138 vulnerabilities patched), and security reporting indicates the RCE is being exploited with domain controllers at risk; a public proof-of-concept is available, it is not yet in CISA KEV, and EPSS assigns a 79.6% probability of exploitation within 30 days.
    · microsoft Windows Server 2012 · microsoft Windows Server 2016 PoC ×3mass

Appears with

organization CERT-EU 1organization Microsoft 1product Windows Netlogon 1product Windows Server 1vendor CERT-EU 1vendor Microsoft 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.