Critical RCE Vulnerability in Windows Netlogon Service (CVE-2026-41089)

CVE-2026-41089 is a critical remote code execution (RCE) vulnerability in the Windows Netlogon service, carrying a CVSS score of 9.8. The flaw is caused by a stack-based buffer overflow (CWE-121) that allows unauthenticated attackers to execute arbitrary code with SYSTEM privileges. While Microsoft initially reported no active exploitation on May 12, 2026, the Centre for Cybersecurity Belgium (CCB) updated its guidance on May 29, 2026, confirming that the vulnerability is being actively exploited in the wild.

The vulnerability is particularly dangerous because it targets domain controllers, which are the core of Active Directory identity infrastructure. Successful exploitation allows for full domain compromise, credential theft, and lateral movement without requiring any prior user interaction or valid credentials. Affected versions include Windows Server 2012 through Windows Server 2025. Organizations are urged to prioritize patching domain controllers and restricting network access to the Netlogon RPC interface.