Windows Netlogon Stack Buffer Overflow CVE-2026-41089: Critical RCE Risk
CVE-2026-41089 is a critical stack-based buffer overflow in Windows Netlogon allowing unauthenticated remote code execution on all supported Windows Server versions. CVSS 9.8.
TL;DR
- CVE-2026-41089 is a stack-based buffer overflow (CWE-121) in the Windows Netlogon service, rated CVSS 9.8 (Critical).
- An unauthenticated, remote attacker can send a crafted network request to trigger the overflow and execute arbitrary code on the target.
- Every currently supported Windows Server release - 2012 through 2025 - is listed as affected.
- No confirmed in-the-wild exploitation exists at the time of writing; it is not in the CISA KEV catalog.
- Apply the patch described in the Microsoft Security Response Center advisory immediately and restrict Netlogon exposure at the network boundary.
What is CVE-2026-41089?
CVE-2026-41089 is a stack-based buffer overflow in the Windows Netlogon service that lets an unauthenticated attacker send a malformed network request, overflow a fixed-size stack buffer, and redirect execution to attacker-controlled code - all without any credentials or user interaction. Because Netlogon underpins domain authentication, exploitation could compromise an entire Active Directory environment from a single packet.
The weakness is classified as CWE-121 (Stack-based Buffer Overflow), a classic memory-safety flaw in which a program writes past the end of a stack-allocated buffer. On Windows, the Netlogon service (netlogon.dll / lsass.exe) processes authentication traffic on behalf of the domain, making it a high-value target. A successful overflow here can overwrite the saved return address or structured exception handler pointer, handing the attacker full control of the process.
Who is affected?
Every supported Windows Server version is in scope according to NVD CPE data:
- Microsoft Windows Server 2012
- Microsoft Windows Server 2016
- Microsoft Windows Server 2019
- Microsoft Windows Server 2022
- Microsoft Windows Server 2022 23H2
- Microsoft Windows Server 2025
Domain controllers carry the highest risk because they process the most Netlogon traffic, but any domain member with Netlogon exposed could be targeted for lateral movement or relay attacks.
How severe is it?
The CVSS 3.1 base score of 9.8 sits at the top of the Critical band. Breaking down the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
| Metric | Value | Meaning |
|---|---|---|
| Attack Vector | Network | Exploitable remotely over any routed network |
| Attack Complexity | Low | No special conditions or race conditions required |
| Privileges Required | None | No account needed |
| User Interaction | None | Victim need not click anything |
| Confidentiality | High | Full read access to process memory and secrets |
| Integrity | High | Arbitrary write / code execution |
| Availability | High | Service crash or denial at minimum |
In practice, code execution inside lsass.exe gives an attacker access to every Kerberos ticket, NTLM hash, and credential cached on that system - the keys to a domain. The combination of no authentication barrier and high impact on all three security properties makes this one of the more dangerous server-side flaws of recent memory.
Is it being exploited?
CVE-2026-41089 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no confirmed public in-the-wild exploitation has been reported at the time of writing. That said, Netlogon vulnerabilities historically attract rapid weaponization once proof-of-concept code circulates - ZeroLogon (CVE-2020-1472) went from disclosure to widespread exploitation within days. Treat the absence of KEV listing as a window to patch, not a reason to delay.
How to fix and mitigate it
-
Apply the official patch. Consult the Microsoft Security Response Center advisory for CVE-2026-41089 for the exact update package for your Windows Server version. Do not wait for a maintenance window on domain controllers.
-
Prioritize domain controllers. Patch DCs first; they handle the highest volume of Netlogon authentication and are the most attractive target.
-
Restrict Netlogon traffic at the network perimeter. Block inbound TCP 135 (RPC endpoint mapper) and the dynamic RPC range from untrusted networks. Domain members only need Netlogon access from within the domain VLAN.
# Example: block inbound RPC from non-domain subnets using Windows Firewall New-NetFirewallRule -DisplayName "Block External RPC" ` -Direction Inbound ` -Protocol TCP ` -LocalPort 135 ` -RemoteAddress Internet ` -Action Block -
Enable Windows Defender Credential Guard on supported builds to isolate lsass from direct memory access by exploits targeting the process.
-
Monitor Netlogon service restarts. An unexpected lsass or Netlogon crash may indicate a failed exploitation attempt and warrants immediate investigation.
-
Audit domain controller exposure. Use network scans to confirm no domain controller has Netlogon ports reachable from untrusted segments or the internet.
How to detect exposure
Check your patch level against the build numbers listed in the MSRC advisory:
# Retrieve OS build version on a Windows Server
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').CurrentBuildNumber
Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-30) } | Sort-Object InstalledOn -Descending
Review Netlogon event logs for anomalous authentication failures or unexpected service errors:
# Pull Netlogon-related warnings and errors from the System log
Get-WinEvent -LogName System | Where-Object {
$_.ProviderName -eq 'NETLOGON' -and $_.LevelDisplayName -match 'Error|Warning'
} | Select-Object TimeCreated, Message -First 50
Scan your perimeter with a tool like Nmap to verify TCP 135 is not reachable from untrusted networks:
nmap -p 135,445 --open <dc-ip-range>
If your EDR platform supports it, create a detection rule for stack pivot or ROP chain activity within lsass.exe - this catches exploitation attempts even before signatures are available.
Frequently asked questions
Does an attacker need credentials to exploit CVE-2026-41089?
No. The CVSS vector shows PR:N (no privileges required) and UI:N (no user interaction), meaning an unauthenticated attacker on the network can attempt exploitation directly against an exposed Netlogon service without any prior account access.
Which Windows Server versions are vulnerable?
Microsoft Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025 are all listed as affected. Both domain controllers and member servers running Netlogon should be treated as in scope until patched.
Is CVE-2026-41089 being actively exploited in the wild?
As of the time of writing, CVE-2026-41089 is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed in-the-wild exploitation has been reported. The critical severity still warrants immediate patching given the zero-barrier attack conditions.
Can a firewall block this attack without patching?
Restricting inbound TCP 445 and the Netlogon RPC port (135 plus dynamic RPC range) at the network perimeter reduces exposure but does not eliminate risk from lateral movement within a domain environment. Patching remains the only definitive fix.
