2026-007: Critical Vulnerability in Windows Netlogon
Actively exploited CVSS 9.8 Windows Netlogon flaw lets unauthenticated attackers execute code with SYSTEM privileges on domain controllers.
Microsoft's May 2026 advisory describes CVE-2026-41089, a stack-based buffer overflow in Windows Netlogon (CVSS 9.8) that allows unauthenticated remote code execution with SYSTEM privileges on domain controllers via specially crafted packets. The Centre for Cybersecurity Belgium reports the flaw is currently being exploited by threat actors. All Windows Server versions from 2012 through 2025 acting as domain controllers are affected and require the May updates.
- Unauthenticated RCE with SYSTEM privileges on targeted domain controllers
- Actively exploited in the wild according to Belgium's CCB
- Affects Windows Server 2012 through 2025 domain controllers
- Stack-based buffer overflow triggered by crafted network packets
- CVEs
- CVE-2026-41089
- Products
- Windows ServerWindows Netlogon
- Organizations
- MicrosoftCERT-EUCentre for Cybersecurity Belgium
- Countries
- Belgium
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41089 | Unauthenticated Stack Buffer Overflow RCE in Windows Server Netlogon (CVE-2026-41089) | 9.8 | 80% | PoC ×6 |
From the original article
1 min read at cert.europa.eu
On 12 May 2026, Microsoft published a security advisory addressing a critical vulnerability affecting Windows Server when acting as a domain controller. This vulnerability allows an unauthenticated attacker to execute arbitrary code over a network. According to The Centre for Cybersecurity Belgium (CCB), this vulnerability is currently exploited by threat actors.
cert.europa.eu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.