{"id":455581,"date":"2026-06-01T15:08:09","date_gmt":"2026-06-01T15:08:09","guid":{"rendered":"https:\/\/www.newsbeep.com\/nz\/455581\/"},"modified":"2026-06-01T15:08:09","modified_gmt":"2026-06-01T15:08:09","slug":"windows-netlogon-rce-exploited-domain-controllers-at-risk-cve-2026-41089","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/nz\/455581\/","title":{"rendered":"Windows Netlogon RCE exploited, domain controllers at risk (CVE-2026-41089)"},"content":{"rendered":"

CVE-2026-41089, a critical Windows Netlogon RCE flaw that allows remote code execution, is now actively exploited in the wild, the Centre for Cybersecurity Belgium (CCB) warned<\/a> on Friday.<\/p>\n

\"Windows<\/p>\n

About CVE-2026-41089<\/p>\n

CVE-2026-41089 is a stack-based buffer overflow vulnerability in Windows Netlogon, the service and protocol that handles authentication and security within a Windows domain environment.<\/p>\n

The flaw can be exploited by attackers by sending a specially crafted network request to a Windows server that is acting as a domain controller, and may allow them to execute code over a network.<\/p>\n

The company disclosed<\/a> the vulnerability on May 12, 2026, and credited its Windows Attack Research & Protection (WARP) team with reporting it.<\/p>\n

At the time, Microsoft deemed the flaw to be \u201cless likely\u201d to be exploited, but AI-enabled adversaries are shrinking<\/a> the gap between a CVE\u2019s public disclosure and the first observed exploitation by threat actors.<\/p>\n

Security researchers and AI companies are, likewise, reverse-engineering patches and publicly sharing<\/a> their root cause analyses and proof-of-concept exploits.<\/p>\n

Unfortunately, CCB has yet to publicly share details about the attacks in progress.
We\u2019ve reached out to CCB with questions about the in-the-wild exploitation and will update this article when we hear back from them.<\/p>\n

What to do?<\/p>\n

Microsoft issued security patches for CVE-2026-41089 across multiple Windows Server versions in last week\u2019s Patch Tuesday release.<\/p>\n

At the time<\/a>, Jason Kikta, CTO at Automox, advised admins to patch the flaw on all domain controllers in the same maintenance window, while noting that \u201chalf-patched forests are not a defensible state for a pre-auth [Domain Controller] bug.\u201d <\/p>\n

He also advised security teams to restrict Netlogon traffic at the network layer and review their DC exposure. <\/p>\n

\u201cInside an already-compromised perimeter, CVE-2026-41089 becomes a fast path to forest-wide takeover,\u201d he noted, and outlined events that might point to active exploitation: <\/p>\n

The Netlogon service unexpectedly crashing or restarting
\nAnomalous Netlogon traffic patterns from non-DC source addresses
\nAuthentication failures or domain trust errors immediately after suspicious network activity hits a domain controller.<\/p>\n

Acros Security has released micropatches<\/a> for CVE-2026-41089 for legacy Windows Server versions: Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2.<\/p>\n

<\/p>\n

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!<\/a><\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"CVE-2026-41089, a critical Windows Netlogon RCE flaw that allows remote code execution, is now actively exploited in the…\n","protected":false},"author":2,"featured_media":455582,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[231596,231597,231598,111,139,69,208626,145,35931,166811],"class_list":["post-455581","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-0patch","tag-acros-security","tag-automox","tag-new-zealand","tag-newzealand","tag-nz","tag-poc","tag-technology","tag-vulnerability","tag-windows-server"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/455581","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=455581"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/455581\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/455582"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=455581"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=455581"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=455581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}