Windows Netlogon CVE-2026-41089: Domain Controller RCE Is Now Exploited

Belgium’s Centre for Cybersecurity Belgium has updated its May Patch Tuesday warning to say that Windows Netlogon CVE-2026-41089 is now being actively exploited in the wild.^[1] The practical audience is narrow but important: organizations running Windows Server domain controllers should treat this as an emergency patch and monitoring item, not as another routine monthly update.

Microsoft disclosed CVE-2026-41089 on May 12, 2026 as a Windows Netlogon remote code execution vulnerability. The company describes it as a stack-based buffer overflow that can be triggered over the network by an unauthorized attacker.^[2] NVD lists the Microsoft CVSS v3.1 score as 9.8 Critical, with network attack vector, low attack complexity, no privileges required, and no user interaction.^[3]

Patch domain controllers first, then reduce Netlogon reachability

The CCB’s May 29 update is the reason this moved from a high-priority Patch Tuesday item into a live-response story. Its advisory says exploitation does not require prior privileges or user interaction, can be executed remotely, and may allow code execution with SYSTEM privileges on a Windows server acting as a domain controller.^[1] That is the worst place for an unauthenticated RCE to land: a domain controller is part of the identity tier that authenticates users, machines, services, trusts, and administrative access across a Windows domain.

There is one important evidence nuance. At the time this article was prepared, Microsoft’s own Security Update Guide data still listed the CVE as not publicly disclosed and not exploited, while CCB and follow-up reporting said attacks had been observed.^[2][4] CCB has not published attack telemetry or indicators, so defenders should avoid guessing at a single exploit pattern. The safer assumption is that any unpatched domain controller reachable from broad internal networks deserves immediate attention.

NVD’s affected configuration list includes Windows Server 2012 and 2012 R2, plus Windows Server 2016, 2019, 2022, 2022 23H2, and 2025 builds below the fixed May 2026 levels.^[3] In plain terms, the first inventory question is not “Do we run Windows?” but “Which systems are domain controllers, and have every one of them received the May 2026 security updates?” Patch all domain controllers in the same maintenance window where possible, then verify the update state instead of relying on deployment intent.

While patching is being completed, reduce unnecessary paths to Netlogon and domain-controller RPC services. Domain controllers should not be reachable from DMZ systems, guest networks, broad client VLANs, or VPN profiles that do not need direct authentication-plane access. That hardening will not replace the Microsoft fix, but it can make exploitation harder from compromised workstations or footholds inside a flat network.

For triage, look for symptoms that match a fragile pre-authentication service bug rather than only classic malware indicators: unexpected Netlogon or LSASS crashes, domain-controller reboots, unusual Netlogon traffic from non-DC systems, authentication failures clustered around suspicious network activity, new trust issues, and abnormal privileged logons after a service disruption. If those signs appear on an unpatched domain controller, treat the investigation as a possible Tier 0 compromise rather than a single-host cleanup.

This is also a good moment to compare Netlogon response with other recent Microsoft-facing incidents. HowToFix recently covered Microsoft Defender vulnerabilities being exploited and Microsoft Exchange OWA exploitation; both stories share the same operational lesson: patching matters most on systems that sit close to identity, mail, security tooling, or remote access. The same prioritization applies to VPN and edge-device bypass flaws, where one exposed service can become the first step toward domain-level access.

References

1. Centre for Cybersecurity Belgium. “Warning: Microsoft Patch Tuesday May 2026 patches 118 vulnerabilities…” Updated May 29, 2026. CCB advisory.
2. Microsoft Security Response Center. “CVE-2026-41089: Windows Netlogon Remote Code Execution Vulnerability.” Published May 12, 2026. MSRC advisory.
3. National Vulnerability Database. “CVE-2026-41089 Detail.” Published May 12, 2026; modified May 15, 2026. NVD entry.
4. BleepingComputer. “Critical Windows Netlogon RCE flaw now exploited in attacks.” June 1, 2026. Report.
5. Help Net Security. “Windows Netlogon RCE exploited, domain controllers at risk (CVE-2026-41089).” June 1, 2026. Report.