CVE-2026-41089 is a critical (CVSS 9.8) stack-based buffer overflow in Windows Netlogon that allows unauthenticated remote code execution with SYSTEM privileges via specially crafted network packets. Affected versions include Windows Server 2012/R2, Windows Server 2016 prior to 10.0.14393.9140, Windows Server 2019 prior to 10.0.17763.8755, Windows Server 2022 prior to 10.0.20348.5074, and Windows Server 2022 23H2 prior to 10.0.25398.2330. Immediate patching to these specified fixed versions is required as this vulnerability is actively exploited.
Security Advisory 2026-007 Home Security Advisories Release Date: 10-06-2026 06:47:08 A A A A Critical Vulnerability in Windows Netlogon Download Download PDF MD5 SHA-1 SHA-256 SHA-512 Download MARKDOWN Download JSON History: 10/06/2026 --- v1.0 -- Initial publication Summary On 12 May 2026, Microsoft published a security advisory addressing a critical vulnerability affecting Windows Server when acting as a domain controller [1]. This vulnerability allows an unauthenticated attacker to execute arbitrary code over a network. According to The Centre for Cybersecurity Belgium (CCB), this vulnerability is currently exploited by threat actors [2]. It is strongly recommended updating affected Windows servers as soon as possible. Technical Details The vulnerability CVE-2026-41089 , with the CVSS score of 9.8, is a stack-based buffer overflow in Windows Netlogon [1]. An unauthenticated attacker could execute arbitrary code with SYSTEM privileges on targeted domain controllers by sending specially crafted packets [3]. Affected Products The following Windows Server versions are affected: Windows Server 2012 / 2012 R2 Windows Server 2016 (prior to 10.0.14393.9140) Windows Server 2019 (prior to 10.0.17763.8755) Windows Server 2022 (prior to 10.0.20348.5074) Windows Server 2022 23H2 (prior to 10.0.25398.2330) Windows Server 2025 (prior to 10.0.26100.32772) Additional information is available in the vendor’s advisory [1]. Recommendations It is recommended updating affected Windows Server asset as soon as possible. References [1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089 [2] https://ccb.belgium.be/advisories/warning-microsoft-patch-tuesday-may-2026-patches-118-vulnerabilities-16-critical-102#:~:text=It%20is%20now%20actively%20exploited%20in%20the%20wild [3] https://www.bleepingcomputer.com/news/microsoft/critical-windows-netlogon-remote-code-execution-flaw-now-exploited-in-attacks/ Share this publication We got cookies We only use cookies that are necessary for the technical functioning of our website. Find out more on here . OK