What is the CVSS score of CVE-2026-41089?

CVE-2026-41089 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows Netlogon are affected by CVE-2026-41089?

A critical remote code execution vulnerability in Windows Netlogon service (CVE-2026-41089) enables unauthenticated attackers to gain unauthorized control over Windows Server 2012-2025 systems,…. A patch is available.

Is there a public PoC exploit available for CVE-2026-41089?

Yes, a public proof-of-concept exploit is available for CVE-2026-41089. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-41089?

Within 24 hours: Immediately identify and inventory all Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 systems; prioritize isolation of production domain controllers from untrusted networks if immediate patching is not feasible. Within 7 days: Deploy Microsoft's released patch to all domain controllers and tier-1 production servers; verify successful installation and monitor for patch-related issues. Within 30 days: Complete patch rollout to all remaining Windows Server systems and conduct validation testing to confirm remediation.

Windows Netlogon CVE-2026-41089

EUVD-2026-29681 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-05-12 microsoft

GHSA-7j2c-v44v-wc8f

Buffer Overflow Microsoft Stack Overflow Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows Server 2022 23H2 Edition Server Core Installation Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable Netlogon RPC with low-complexity stack overflow yields code execution and total impact, so AV:N/AC:L/PR:N with C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:56 vuln.today

CVE Published

May 12, 2026 - 16:58 nvd

CRITICAL 9.8

DescriptionCVE.org

Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

Articles & Coverage 3

thecyberexpress.com AI-Powered Bots Mimic Legitimate Users to Evade Detection (CVE-2026-41089) Jun 04, 2026 POC CVE-2026-41089: Unauthenticated CLDAP Stack Buffer Overflow Enables RCE on Windows Domain Controllers (CVSS 9.8) Jun 02, 2026 blog.talosintelligence.com Microsoft May 2026 Patch Tuesday: 31 Critical RCE Vulnerabilities Including Windows, Office, Azure May 12, 2026

AnalysisAI

Remote code execution in the Windows Netlogon service (across Windows Server 2012 through 2025) allows an unauthenticated attacker to run arbitrary code over the network by triggering a stack-based buffer overflow (CWE-121). With a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N and total technical impact, this is a critical, pre-authentication server-side flaw. Microsoft has released patches; publicly available exploit code exists, though EPSS remains low (0.09%) and there is no confirmed active exploitation at time of analysis.

Technical ContextAI

Netlogon is a core Windows Server component that maintains the secure channel between domain-joined machines and domain controllers, handling authentication (MS-NRPC RPC over SMB/named pipes and TCP) and account/trust validation. The root cause is CWE-121, a stack-based buffer overflow: attacker-controlled input reaching a Netlogon request handler is copied into a fixed-size stack buffer without adequate bounds checking, corrupting the stack and enabling control-flow hijacking. Because Netlogon runs in a privileged context on domain controllers and member servers, successful memory corruption yields code execution in that high-privilege service context. The affected CPE set spans microsoft:windows_server_2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and (per EUVD) 2025, including Server Core installations.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089), which raises each affected build to at least its fixed version: Windows Server 2012 to 6.2.9200.26079, 2012 R2 to 6.3.9600.23181, 2016 to 10.0.14393.9140, 2019 to 10.0.17763.8755, 2022 to 10.0.20348.5139, 2022 23H2 to 10.0.25398.2330, and 2025 to 10.0.26100.32860. Prioritize domain controllers and any internet- or untrusted-network-reachable servers. Because Netlogon RPC is essential to Active Directory operation it cannot simply be disabled, so if immediate patching is impossible, restrict the RPC/SMB attack surface: block inbound TCP 445 and 135 (plus the dynamic RPC range) to domain controllers from untrusted networks and segment DCs behind firewalls - noting these controls can break legitimate domain authentication and replication if applied too broadly, so scope them to non-domain traffic. Monitor domain controller Netlogon activity for anomalous or malformed requests as a detective compensating control.