Windows Netlogon 0?Click RCE Vulnerability Actively Exploited in the Wild (CVE?2026?41089)

Overview

A critical vulnerability in the Windows Netlogon service, tracked as CVE?2026?41089, is now being actively exploited in the wild, posing a significant risk to enterprise environments. |

This vulnerability allows unauthenticated remote attackers to execute arbitrary code on vulnerable systems by sending specially crafted network requests to the Netlogon service.

Due to its zero-click nature (no user interaction required) and ability to target domain controllers, successful exploitation can result in complete domain compromise.

Threat Details

Vulnerability Name: Windows Netlogon RCE
CVE ID: CVE-2026-41089
Severity: Critical (CVSS 9.8)
Vulnerability Type: Remote Code Execution (Stack-based Buffer Overflow)
Affected Component: Windows Netlogon Service
Attack Vector: Network (unauthenticated)
Public PoC Availability: Not widely confirmed
Exploitation Status: Active (in-the-wild exploitation reported)

Who It Impacts

This vulnerability affects:

• Windows Server systems configured as:
  • Domain Controllers
• Supported versions include:
  • Windows Server 2012 and later 

High-risk environments:

• Active Directory infrastructures
• Enterprise identity systems
• Networks with exposed or poorly segmented domain controllers

Affected Products

• Microsoft Windows Server 2012 and 2012 R2
• Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2
• Microsoft Windows Server 2025

How It Impacts

Technical Details

• The vulnerability exists due to improper handling of crafted Netlogon network requests, leading to a stack-based buffer overflow. 
• Attackers can exploit this flaw by sending specially crafted RPC/Netlogon requests to a domain controller. 

Potential Impact

Successful exploitation allows attackers to:

• Execute arbitrary code with SYSTEM-level privileges
• Gain full control of domain controllers
• Perform:
  • Privilege escalation
  • Credential theft (NTDS.dit dump)
  • Creation of malicious accounts
  • Lateral movement across the network
• Achieve complete Active Directory domain takeover

Risk Considerations

This vulnerability is considered critical risk due to:

• Active exploitation in the wild
• Zero-click / no user interaction required
• No authentication required
• Network-based attack vector
• Impacts domain controllers (identity infrastructure)

A successful attack can lead to full enterprise compromise within minutes

Recommendations

Immediate Actions

• Apply Microsoft security updates released in May 2026 Patch Tuesday
• Prioritize patching:
  • All Domain Controllers (highest priority)
• Restart systems after applying patches

Security Hardening

• Restrict access to:
  • Domain controllers
• Implement:
  • Network segmentation
  • Least privilege access controls

Monitoring & Detection

• Monitor for:
  • Suspicious Netlogon traffic
  • Abnormal authentication patterns
  • Unexpected privilege escalation activity
• Investigate:
  • New or modified administrative accounts
  • Unusual domain controller behavior

Long-Term Actions

• Regularly patch all Windows systems
• Conduct Active Directory security audits
• Implement Zero Trust architecture for identity systems

References

• Windows Netlogon 0-Click RCE Vulnerability Now Actively Exploited In The Wild
• Critical Windows Netlogon RCE flaw now exploited in attacks
• Windows Netlogon 0-Click RCE Flaw Exploited in the Wild
• https://nvd.nist.gov/vuln/detail/CVE-2026-41089