PatchaPalooza

CVE-2026-41089: Windows Netlogon Remote Code Execution Vulnerability

CVE-2026-41089 is a remote code execution vulnerability in Windows Netlogon, rated Critical by Microsoft, with a CVSS 3.1 base score of 9.8 (Critical). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 78.33% probability of exploitation activity in the next 30 days, higher than 100% of all scored vulnerabilities. Microsoft released the fix on 12 May 2026 in the May 2026 Patch Tuesday, delivered through 9 security updates (KB5087538, KB5087545, KB5087424, KB5087539 and more). It affects 13 products in 2 product families (Windows, ESU).

Key facts

CVE ID
CVE-2026-41089
Severity
Critical CVSS 9.8
Microsoft severity
Critical
Impact
Remote Code Execution
Exploited in the wild
No
Publicly disclosed
No
Exploitation likelihood
Less Likely
Weakness
CWE-121
EPSS
78.33% (percentile 100%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
May 2026 Patch Tuesday
Product families
Windows, ESU

From the May 2026 Patch Tuesday briefing

Windows Netlogon Remote Code Execution

An attacker can potentially run code on a Windows domain-joined system by sending specially crafted network traffic to the Netlogon service, turning a reachable machine into an initial foothold or a rapid lateral-movement pivot. In real terms, this is the kind of bug that can be used to jump from one compromised endpoint to broader domain compromise if attackers can reach the service over the network. With a CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a stack-based buffer overflow (CWE-121), this is the archetypal high-risk Windows networking bug: network-reachable, no authentication, no user interaction. In practical terms, any host exposing the vulnerable Netlogon pathway to an attacker-controlled network segment becomes a candidate for unauthenticated remote code execution. While many environments restrict direct exposure of domain controller services, the real-world risk is often east-west: once an attacker lands on any internal foothold (phishing, VPN abuse, compromised workstation), they can pivot to target domain controllers or member servers over internal routing.

From the briefing, written by an AI model from PatchaPalooza's data.

CVSS score and vector

Microsoft scores CVE-2026-41089 at 9.8 (temporal 8.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

MetricValue
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit code maturityUnproven
Remediation levelOfficial fix
Report confidenceConfirmed

Description

Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

Frequently asked questions (Microsoft)

How could an attacker exploit this vulnerability?

An attacker could send a specially crafted network request to a Windows server that is acting as a domain controller. If successful, this could cause the Netlogon service to improperly handle the request, potentially allowing the attacker to run code on the affected system without needing to sign in or have prior access.

Affected products (13)

Windows

ProductSecurity updateTypeFixed buildRestart
Windows Server 2019KB5087538Security Update10.0.17763.8755Yes
Windows Server 2019 (Server Core installation)KB5087538Security Update10.0.17763.8755Yes
Windows Server 2022KB5087545
KB5087424		Security Update
Security Hotpatch Update		10.0.20348.5139
10.0.20348.5074		Yes
Yes
Windows Server 2022 (Server Core installation)KB5087545
KB5087424		Security Update
Security Hotpatch Update		10.0.20348.5139
10.0.20348.5074		Yes
Yes
Windows Server 2025 (Server Core installation)KB5087539
KB5087423		Security Update
Security Hotpatch Update		10.0.26100.32860
10.0.26100.32772		Yes
Yes
Windows Server 2022, 23H2 Edition (Server Core installation)KB5087541Security Update10.0.25398.2330Yes
Windows Server 2025KB5087539
KB5087423		Security Update
Security Hotpatch Update		10.0.26100.32860
10.0.26100.32772		Yes
Yes
Windows Server 2016KB5087537Security Update10.0.14393.9140Yes
Windows Server 2016 (Server Core installation)KB5087537Security Update10.0.14393.9140Yes

ESU

ProductSecurity updateTypeFixed buildRestart
Windows Server 2012KB5087470Monthly Rollup6.2.9200.26079Yes
Windows Server 2012 (Server Core installation)KB5087470Monthly Rollup6.2.9200.26079Yes
Windows Server 2012 R2KB5087471Monthly Rollup6.3.9600.23181Yes
Windows Server 2012 R2 (Server Core installation)KB5087471Monthly Rollup6.3.9600.23181Yes

Security updates (9)

Exploitation and detection

VulnCheck KEV

Date added
Ransomware use
Unknown
Independent sources
3

Public exploits (10)

Detection and weaponization

Weaponization maturity: Detection.

Sigma rules (1)

Proof-of-concept repositories (6)

NIST NVD data

NVD status
Analyzed
NVD CVSS
9.8 (CRITICAL)
NVD weakness
CWE-121
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
windows server 2012all listed versions
windows server 2012 r2all listed versions
windows server 2016before 10.0.14393.9140
windows server 2019before 10.0.17763.8755
windows server 2022before 10.0.20348.5074
windows server 2022 23h2before 10.0.25398.2330
windows server 2025before 10.0.26100.32772

References

Acknowledgments

Revision history

VersionDateDescription
1.0Information published.

Sources