Windows Netlogon CVE-2026-41089

No special conditions beyond network reachability - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against default configurations of Windows Server systems running the Netlogon service, which is inherently enabled on domain controllers and domain-joined servers. The exploitable surface is the Netlogon RPC interface, typically reached via SMB named pipes (TCP 445) or RPC endpoints (TCP 135 plus dynamic ports). Limiting factors: the attacker must have a network path to the vulnerable Netlogon endpoint, so servers whose RPC/SMB ports are firewalled from untrusted networks are not directly reachable; exploitation targets Windows Server builds below the fixed versions listed, and patched systems are not affected.

The signals are partially conflicting and warrant judgment. CVSS 3.1 rates this 9.8 Critical (network vector, low complexity, no privileges, no user interaction, total C/I/A impact), and CISA SSVC lists Automatable: yes with Technical Impact: total - both pointing to a high-priority, wormable-class flaw in a ubiquitous enterprise service. However, EPSS is only 0.09% (26th percentile) and SSVC Exploitation is 'none', meaning no observed exploitation despite publicly available exploit code. This is a real priority: Netlogon RCE historically (e.g. Zerologon-class issues) draws attacker attention quickly, and the combination of unauthenticated network reach plus 'Automatable: yes' means the low EPSS should be read as 'not yet widely exploited' rather than 'low risk.' Treat the low EPSS as a lagging indicator, not a reason to defer patching.

An attacker with network reachability to a domain controller or member server (no credentials required per the CVSS PR:N vector) sends a crafted Netlogon RPC request whose oversized field overflows a fixed-size stack buffer, hijacking control flow to execute code in the privileged Netlogon service context. Publicly available proof-of-concept code (referenced on GitHub and a public gist) lowers the barrier to weaponization, and the low attack complexity means exploitation can be scripted against exposed servers.