CVE-2026-41089: Windows Netlogon Critical RCE

Subash Ghimire@iamsubashg

•updated Jun 9, 2026•14•0•59

CVE-2026-41089 is a stack-based buffer overflow vulnerability located within the Windows Netlogon service (netlogon.dll). Netlogon is a core Authentication Service component that maintains the secure channel (Schannel) between domain-joined computers and Domain Controllers (DCs) for user authentication. CVSSv3: 9.8 Impacts: Because the Netlogon service runs as SYSTEM (or effectively within lsass.exe which has SYSTEM privileges), any code executed via this exploit inherits those permissions. This allows the attacker to: Install malicious services or persistence mechanisms. Dump the NTDS.dit database (all credential hashes). Create Golden Tickets (Kerberos Ticket Granting Tickets) for total domain persistence.