Critical Windows Netlogon RCE flaw now exploited in attacks

The Netlogon Nightmare

On May 12, 2026, Microsoft patched a critical Windows Netlogon vulnerability. This vulnerability, tracked as CVE-2026-41089, has a CVSS score of 9.8. It’s a stack-based buffer overflow issue that could be exploited via crafted network requests. The severity of this issue can’t be overstated: it allows unauthenticated attackers to gain remote code execution on targeted domain controllers without needing to sign in or have prior access. For organizations using Windows domain controllers, this is a major concern.

The Centre for Cybersecurity Belgium warned about the exploitation of this vulnerability. An attacker could send a specially crafted network request to a Windows server acting as a domain controller. If successful, this could cause the Netlogon service to improperly handle the request, potentially allowing the attacker to run code on the affected system. Microsoft’s Windows Attack Research & Protection team reported the vulnerability. Windows domain-based networks, specifically Windows servers acting as domain controllers, are affected by this cybersecurity issue.

Under the Hood

The rapid exploitation of the Windows Netlogon vulnerability highlights the increasing speed and sophistication of threat actors. They are using AI-powered tools to quickly develop exploits for newly disclosed vulnerabilities, shrinking the window for organizations to apply patches. The situation unfolded quickly. Microsoft patched the vulnerability on May 12, 2026, and publicly disclosed it the same day. However, by the following week, threat actors had already started exploiting the vulnerability in attacks. The Centre for Cybersecurity Belgium issued a warning, emphasizing the need for immediate action. This incident is reminiscent of recent attacks on Exchange Server and PrintNightmare vulnerabilities. Threat actors quickly seized on newly disclosed flaws to launch widespread attacks.

The fact that Microsoft patched this vulnerability so quickly is a testament to the company’s commitment to security. But it’s also a reminder that threat actors are getting faster and more sophisticated. They can develop exploits in a matter of days, which means organizations need to be vigilant. The CVSS score of 9.8 for this vulnerability indicates its high severity. Organizations that haven’t applied the May 2026 Patch Tuesday security updates are at risk.

For Defenders

To prevent remote code execution, organizations should apply the May 2026 Patch Tuesday security updates to Windows servers acting as domain controllers. They should also patch the critical Windows Netlogon vulnerability and block specially crafted network requests to Windows servers acting as domain controllers. Enabling security measures to detect and prevent stack-based buffer overflow attacks on Windows Netlogon is crucial. Monitoring domain controllers for suspicious activity and potential exploitation of CVE-2026-41089 is essential. The fallout from this vulnerability could be severe. So, it’s critical that organizations take action now.

Organizations need to take a proactive approach to security. This includes regularly updating software, monitoring for suspicious activity, and having incident response plans in place. The Windows Netlogon vulnerability is just one example of the types of threats that organizations face. But by taking the right steps, they can protect themselves and their users.

Sources

1. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089
2. https://ccb.belgium.be/advisories/warning-microsoft-patch-tuesday-may-2026-patches-118-vulnerabilities-16-critical-102
3. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45585
4. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825
5. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091
6. https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41089
7. https://aretiq.ai/research/vul260513-cve-2026-41089-microsoft-windows-netlogon-buildsamlogonresponse-stack-based-buffer-overflow-rce/
8. https://msrc-blog.microsoft.com/2026/05/12/may-2026-patch-tuesday/
9. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41089