CVE-2026-41089

What it actually does

CVE-2026-41089 is a network-reachable stack-based buffer overflow in the Windows Netlogon service on affected Windows Server versions. Because the flaw is unauthenticated, low-complexity, and requires no user interaction, a remote attacker who can reach Netlogon-related network services may send crafted data that corrupts process memory and redirects execution flow. Successful exploitation can result in arbitrary code execution with the privileges of the affected service context, which on domain controllers and Windows servers can have severe confidentiality, integrity, and availability impact.

Why it matters to the business

This vulnerability can allow an external or internal attacker to take control of affected Windows servers over the network, potentially leading to domain compromise, service outages, credential theft, data exposure, ransomware deployment, and disruption of authentication-dependent business operations. The risk is elevated because the CVSS score is critical, EPSS is high at 0.79622, the issue has been public for about 90 days, and the affected product set includes widely deployed Windows Server releases from 2012 through 2025. Although it is not currently listed in CISA KEV and no ransomware use is indicated, the combination of unauthenticated remote code execution and domain service exposure warrants urgent remediation.

How an attack unfolds

An attacker first identifies Windows Server systems exposing services used by Netlogon, commonly through network discovery of domain controllers or servers reachable over SMB/RPC-related ports. The attacker then sends specially crafted Netlogon protocol data intended to overflow a stack buffer in the vulnerable component. If memory corruption is controlled successfully, the attacker gains code execution on the target without needing valid credentials or user interaction. From that foothold, the attacker may run commands, deploy tooling, dump credentials from memory or disk, create persistence, move laterally to other servers, target Active Directory infrastructure, disable defenses, or stage ransomware/data theft operations. Failed exploitation attempts may cause Netlogon, LSASS, or the server itself to crash or restart, producing authentication disruption and forensic artifacts.

How to fix it

Apply the vendor security update for all affected Windows Server versions as soon as it is available through Microsoft Update, Windows Server Update Services, Microsoft Update Catalog, or the organization’s endpoint/server patching platform. Because no exact fixed versions were provided, remediation should be tracked by confirming installation of the Microsoft security update that explicitly addresses CVE-2026-41089 for each affected OS release: Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025. Prioritize domain controllers, externally reachable servers, servers reachable from untrusted network segments, and systems providing authentication or identity services. If immediate patching is not possible, reduce exposure by restricting inbound access to SMB/RPC/Netlogon-related services to trusted administrative and domain networks only, blocking unnecessary access at firewalls, isolating legacy servers, enforcing network segmentation, monitoring for crashes or anomalous Netlogon traffic, and ensuring endpoint protection is active. Mitigations should be treated as temporary; they do not replace patching.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows Server has installed the relevant Microsoft security update addressing the vulnerability and has been rebooted if required. Use centralized patch compliance tooling, Windows Update history, Microsoft Update Catalog package checks, or PowerShell-based inventory to confirm applicable cumulative updates are present across all supported server versions. Validate that domain controllers and other high-risk servers are no longer missing the relevant monthly security update. From a network perspective, verify that Netlogon/SMB/RPC exposure is limited to required trusted segments and that unauthenticated access from untrusted networks is blocked. Where appropriate, run authenticated vulnerability scans after patching to confirm the finding is closed; avoid using untrusted proof-of-concept exploit code for validation on production systems.

Typical attack path

1. Scan for Windows Server systems, especially domain controllers or servers exposing SMB/RPC/Netlogon-accessible services.
2. Confirm that the target appears to be an affected Windows Server version and is reachable over the network.
3. Send crafted Netlogon traffic designed to trigger the stack-based buffer overflow.
4. Achieve memory corruption and redirect execution to attacker-controlled code.
5. Execute commands under the vulnerable service context or obtain a privileged foothold on the server.
6. Dump credentials, enumerate Active Directory, and identify additional high-value systems.
7. Move laterally using stolen credentials or remote administration protocols.
8. Establish persistence, exfiltrate data, disrupt authentication services, or deploy ransomware/destructive payloads.

How to detect it

To determine whether exploitation has already occurred, review Windows System, Application, Security, Directory Service, PowerShell, Sysmon, EDR, firewall, VPN, and network IDS logs for activity around domain controllers and affected Windows servers. Look for crashes or restarts of Netlogon, LSASS, or related services; Windows Error Reporting events referencing netlogon.dll or lsass.exe; unexpected server reboots; spikes in malformed SMB/RPC/Netlogon traffic; and repeated connection attempts to domain controllers from unusual sources. Correlate any crash events with inbound network connections to SMB/RPC ports shortly before the failure. Because successful exploitation may transition quickly into post-exploitation, also hunt for suspicious child processes, credential access tools, creation of new services or scheduled tasks, abnormal administrative logons, unexpected PowerShell or command-line execution, new or modified privileged accounts, unusual DCSync-like replication activity, and lateral movement from compromised servers. Useful Windows events include System service-crash events such as 7031/7034, Application crash events such as 1000/1001, Security logon events such as 4624/4625/4672, service creation event 7045, scheduled task events 4698/4702, process creation events 4688 or Sysmon Event ID 1, and directory replication or privileged account change events where available.

• The Netlogon service terminated unexpectedly
• Faulting application name: lsass.exe
• Faulting module name: netlogon.dll
• Event ID 7031
• Event ID 7034
• Event ID 1000
• Event ID 1001
• Event ID 7045
• Event ID 4624
• Event ID 4625
• Event ID 4672
• Event ID 4688
• Event ID 4698
• Event ID 4702
• Sysmon Event ID 1
• lsass.exe
• netlogon.dll
• Netlogon
• \\PIPE\\netlogon
• TCP/445
• TCP/135

What your security team should do

• Treat this as an urgent critical remote code execution risk despite the absence of CISA KEV listing, due to unauthenticated network exploitability and high EPSS probability.
• Immediately inventory affected Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025 systems, prioritizing domain controllers and authentication infrastructure.
• Patch or otherwise apply the vendor-provided security update on all affected servers, with emergency change handling for internet-exposed or broadly reachable systems.
• Restrict inbound SMB/RPC/Netlogon-related access to trusted networks only and block exposure from the internet or untrusted segments.
• Hunt for signs of exploitation, including Netlogon or LSASS crashes, unexpected reboots, suspicious network logons, and post-exploitation activity from server processes.
• Increase monitoring on domain controllers for credential dumping, new privileged accounts, abnormal Kerberos/NTLM activity, remote service creation, scheduled tasks, and lateral movement.
• Ensure recent offline or immutable backups exist for domain controllers and critical Windows servers before and after emergency patching.
• If exploitation is suspected, isolate affected systems, preserve forensic evidence, rotate potentially exposed credentials, and perform Active Directory compromise assessment.