Skip to main content
CTI blog image
Emerging Issue

Critical Netlogon RCE on domain controllers (CVE-2026-41089)

A critical, unauthenticated remote code execution vulnerability in Windows Netlogon (CVE-2026-41089, CVSS 9.8) lets a remote attacker run code as SYSTEM on a domain controller. Patch all domain controllers in the same maintenance window with the May 2026 security updates.

Microsoft’s May 12, 2026, Patch Tuesday addressed a critical remote code execution flaw in Windows Netlogon (CVE-2026-41089): a stack-based buffer overflow (CWE-121) with a CVSS score of 9.8, discovered internally by Microsoft’s Windows Attack Research & Protection (WARP) team. Microsoft rated it “Less likely” to be exploited at release.

On May 29, 2026, the Centre for Cybersecurity Belgium (CCB) warned that attackers were exploiting CVE-2026-41089 in the wild and urged immediate patching. Microsoft says it has no evidence of exploitation but still recommends applying the update, and several vendors report that public proof-of-concept code is circulating.

What the vulnerability is

Netlogon is the Windows service responsible for authentication within a domain. CVE-2026-41089 is a stack-based buffer overflow in how the Netlogon service handles a crafted network request: a malformed CLDAP request to UDP port 389 overflows a fixed-size stack buffer as the service builds its response. The affected code runs inside the LSASS process on the domain controller, so an unauthenticated attacker who can reach the service over the network can corrupt memory and, under the right conditions, execute code as the SYSTEM account—effectively inheriting the full identity of the domain controller—up to full Active Directory takeover. Failed attempts commonly crash LSASS and reboot the domain controller, creating a denial-of-service condition for the directory tier. Mapped to MITRE ATT&CK, the relevant techniques are T1190, T1210, and T1068.

Key facts to keep in mind

  • Pre-authentication and network-reachable: no credentials, local access, or user interaction required.
  • The exposed surface is Windows Server domain controllers reachable over the network via the Netlogon service (CLDAP, UDP/389).
  • Success yields SYSTEM-level code execution in LSASS; failure commonly crashes LSASS and reboots the domain controller.
  • All supported Windows Server versions configured as domain controllers are affected (Server 2012 through 2025). Microsoft's security updates cover supported versions (Server 2012 and later); legacy out-of-support versions such as Server 2008 R2 are also vulnerable but rely on third-party micropatches (e.g., 0patch/Acros) rather than official Microsoft updates.

How Tanium can help

Tanium Comply: Comply runs vulnerability assessments using the Tanium Vulnerability Library, mapping detections to CVEs and CVSS scores. Run an assessment and filter findings for CVE-2026-41089 to see which systems still need the May 2026 update; prioritize domain controllers first, then the rest of the Windows Server fleet. Confirm library coverage for this CVE, as not every CVE is detectable via Comply assessments.

Tanium Patch: Patch all domain controllers together; partial patching leaves an indefensible state where attackers target the domain controllers you haven't reached. Build a patch list scoped to the May 2026 updates for your Windows Server versions, target your domain controller computer group, and deploy in one coordinated maintenance window. Apply the May 2026 cumulative security update for your Windows Server versions; for current Windows Server and Windows 11 builds this shipped as KB5089549 (OS Builds 26200.8457 and 26100.8457). Confirm the correct KB for each OS build against the Microsoft Security Update Guide for CVE-2026-41089, then re-run the Comply assessment to validate the finding has cleared.

References