cbcvebase.
CVE-2026-41089
published 2026-05-12

CVE-2026-41089: Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

PriorityP195critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
79.62%
99.6th percentile
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

Affected

12 ranges
VendorProductVersion rangeFixed in
microsoftwindows_server_2012
microsoftwindows_server_2012>= 6.2.9200.0 < 6.2.9200.260796.2.9200.26079
microsoftwindows_server_2012_r2>= 6.3.9600.0 < 6.3.9600.231816.3.9600.23181
microsoftwindows_server_2016< 10.0.14393.914010.0.14393.9140
microsoftwindows_server_2016>= 10.0.14393.0 < 10.0.14393.914010.0.14393.9140
microsoftwindows_server_2019< 10.0.17763.875510.0.17763.8755
microsoftwindows_server_2019>= 10.0.17763.0 < 10.0.17763.875510.0.17763.8755
microsoftwindows_server_2022< 10.0.20348.507410.0.20348.5074
microsoftwindows_server_2022>= 10.0.20348.0 < 10.0.20348.513910.0.20348.5139
microsoftwindows_server_2022_23h2< 10.0.25398.233010.0.25398.2330
microsoftwindows_server_2025< 10.0.26100.3277210.0.26100.32772
microsoftwindows_server_2025>= 10.0.26100.0 < 10.0.26100.3286010.0.26100.32860

Detection & IOCsextracted from sources · hover to see the quote

snort
Microsoft Windows Netlogon Remote Code Execution (CVE-2026-41089)
  • CVE-2026-41089 is actively exploited in the wild against Windows Server domain controllers; prioritize detection and patching of all Windows Server versions from 2012 onwards, including Windows Server 2025.
  • Successful exploitation of CVE-2026-41089 may result in SYSTEM-level control of domain controllers; alert on unexpected SYSTEM-level process creation originating from the Netlogon service.
  • ·All currently supported Windows Server versions are affected, including the latest release; patches are available for Windows Server 2012 and later.
  • ·No further technical details on observed in-the-wild attack chains have been publicly disclosed by the reporting authority (CCB) as of the time of reporting.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.