CVE-2026-41089: Windows Netlogon RCE Now Exploited in the Wild

CVE-2026-41089 is a stack-based buffer overflow in the Windows Netlogon Remote Protocol implementation, the protocol domain controllers use to process authentication requests and replicate security data between DCs. The flaw exists in the Netlogon service's handling of inbound RPC requests: a specially crafted packet with a malformed length field causes the service to write data beyond its allocated stack buffer, overwriting the return address on the call stack.

Because the Netlogon RPC interface is exposed by design on every domain controller, no authentication is required to reach the vulnerable code path. An unauthenticated attacker who can send a TCP packet to port 445 on a domain controller has everything needed to trigger the overflow. Microsoft's Windows Attack Research and Protection (WARP) team discovered the flaw internally, meaning no external researcher disclosed a weaponizable technique before the patch, but the flaw's location in the well-understood MS-NRPC protocol made exploitation practical once the patch was reversed by the research community.

The "0-click" designation reflects the absence of any required victim interaction. Traditional network-based vulnerabilities often require a privileged account to connect first, or a user to click a malicious link. CVE-2026-41089 requires neither. An attacker targeting a domain controller sends a crafted Netlogon RPC packet and receives a SYSTEM shell in return.

Microsoft's internal security team confirmed that remote code execution is achievable before public disclosure, explaining the Critical designation and the decision to patch in May 2026 Patch Tuesday, which addressed 138 total vulnerabilities. For organizations that need to understand how attackers chain vulnerabilities to reach domain controllers in multi-step intrusions, see the CVE-2026-41091 Microsoft Defender zero-day patch advisory, which documents how privilege escalation flaws serve as stepping stones toward AD compromise. CVE-2026-41089 eliminates those stepping stones entirely.

CVE-2026-41089 affects every currently supported version of Windows Server that can be configured as a domain controller, from Windows Server 2008 R2 through Windows Server 2025. The affected component is the Netlogon service present in all Windows Server Standard and Datacenter editions across all supported release channels.

Microsoft released patches for all supported versions in the May 2026 Patch Tuesday update cycle. Domain controllers running Windows Server 2022 should install KB5058411; Server 2025 DCs should install KB5058385. For Windows Server 2019, 2016, and 2012 R2 systems, the corresponding cumulative updates from May 2026 include the Netlogon fix. ACROS Security (0patch) released micropatches for legacy Server 2008 R2 systems under Extended Security Updates where Microsoft's full update cycle cannot be applied immediately.

Non-domain controller servers running Windows Server are not directly exploitable via CVE-2026-41089 in the same way. The vulnerable attack surface is specific to servers with the Active Directory Domain Services role enabled. Read-only domain controllers (RODCs) are also in scope: while they cannot originate domain-wide changes, a compromised RODC gives an attacker an authenticated foothold and full visibility into domain topology.

Organizations with multiple domain controllers across geographically distributed sites face compounded risk: Active Directory replication means a compromise of a single unpatched DC can propagate malicious changes to all other DCs in the domain within minutes. Half-patched Active Directory forests are not a defensible posture for a pre-authentication domain controller exploit.

Belgium's Centre for Cybersecurity (CCB) updated its May 2026 Patch Tuesday advisory on May 29, 2026, confirming that attackers are actively exploiting CVE-2026-41089 in the wild. No specific threat actor group has been publicly attributed at the time of this writing, which is consistent with early-stage exploitation where multiple actors independently develop capabilities after reversing the security patch.

The exploitation timeline follows a pattern seen repeatedly across 2026: Microsoft patches a critical vulnerability in Patch Tuesday, proof-of-concept code appears on security research platforms within days, and active exploitation targeting unpatched internet-connected systems begins within two to three weeks of the patch release. CVE-2026-41089 followed this pattern exactly. The Belgian national cybersecurity authority's advisory marks formal public acknowledgment that both opportunistic scanning and targeted exploitation are underway.

The exploit profile makes this vulnerability particularly valuable to ransomware affiliates and initial access brokers operating in 2026. A 0-click pre-authentication RCE against a domain controller eliminates the phishing, credential theft, and lateral movement stages that normally precede Active Directory compromise. An attacker who reaches a vulnerable DC over the network completes what would otherwise be a multi-week intrusion chain in a single exploit step.

The CCB advisory recommends that organizations force MFA for administrator sessions, segment networks to restrict Netlogon RPC access to authorized source addresses, monitor Netlogon RPC activity for anomalous traffic patterns, and test patches in a lab before wide rollout. Given confirmed active exploitation, the lab testing window should be measured in hours, not days.

No threat-actor-specific IOCs such as infrastructure IPs, malicious domains, or file hashes have been publicly released as of June 2, 2026, which reflects the early stage of attribution reporting for this exploitation campaign. Security teams should focus on behavioral detection rather than signature-based IOC matching for CVE-2026-41089.

Review the Windows Event Viewer System log on each domain controller for Event ID 7031 or 7034, which indicate the Netlogon service crashed or restarted unexpectedly. On a healthy, unattacked domain controller the Netlogon service runs continuously without restarts. Unexpected crashes immediately preceding or following anomalous inbound network activity are a strong exploitation indicator.

Network-layer detection should alert on inbound Netlogon RPC connections from source IP addresses outside the known domain controller subnet range. The Netlogon service should only receive connections from domain members and other DCs, not arbitrary internet or DMZ addresses. Any non-DC source initiating Netlogon RPC sessions warrants immediate investigation.

Post-exploitation indicators include new domain administrator account creation captured in Windows Security Event IDs 4720 and 4728 in combination, unexpected process execution under the SYSTEM account on a domain controller captured in Event ID 4688, and Group Policy modifications that were not initiated through authorized change management channels. Security teams running a SIEM should create detection rules for these event combinations today.

The only confirmed effective remediation for CVE-2026-41089 is applying Microsoft's May 2026 Patch Tuesday cumulative updates to every domain controller in the same maintenance window. Patching some DCs while leaving others unpatched is not a defensible posture for a pre-authentication DC vulnerability: AD replication means an attacker who compromises a single unpatched DC can propagate malicious changes to patched DCs through normal domain replication within minutes.

For organizations that cannot patch today due to change management requirements, an emergency mitigating control is available: restrict inbound connections to TCP port 445 on domain controllers using Windows Firewall host-based rules, limiting Netlogon RPC access to source IP addresses in the known domain controller subnet only. This reduces the attack surface but is not a substitute for patching and must be treated as a 24-hour bridge control.

Organizations running Windows Server versions not covered by Microsoft's standard patch cycle should check ACROS Security's 0patch platform for micropatches covering legacy Server 2008 R2 and 2012 systems under Extended Security Updates. For additional context on the current Windows vulnerability landscape, see the BlueHammer RedSun Windows LPE zero-day weekly roundup for the prior wave of active Microsoft exploits.

CVE-2026-41089 does not affect one application or one department's data. Active Directory is the identity fabric that every other system in the network authenticates against. A successful domain controller compromise grants an attacker control over the entire organization's identity infrastructure, not just one server.

The attack path comparison clarifies the risk magnitude. Most ransomware intrusions in 2026 require phishing a user to gain initial access, running privilege escalation tooling to reach an admin account, moving laterally through the network, and then targeting a domain controller as the final objective. CVE-2026-41089 eliminates every step except the initial network access. An attacker with reachability to a domain controller completes what would otherwise be a multi-week intrusion chain in a single exploit packet.

This vulnerability also highlights a structural risk in many organizations' patch management practices: endpoint and web application patches are applied within days of release, but domain controller patching runs on longer validation cycles out of caution for AD stability. That caution is understandable for routine patches, but CVSS 9.8 pre-authentication domain controller RCEs with confirmed active exploitation require the same emergency response timeline as internet-exposed application vulnerabilities. The May 2026 Patch Tuesday update addressing this flaw has been available for three weeks. Any DC still unpatched today is running a known-exploitable configuration against confirmed active attackers.

Belgium's CCB advisory and BleepingComputer's coverage both confirm exploitation is no longer theoretical. The combination of publicly available proof-of-concept code and confirmed attacker activity means every day without the patch is a day of measurable exposure. For organizations with distributed AD forests, every unpatched DC in every site is an independent entry point into the same domain. Patch them all before end of day.