Remote code execution affecting Microsoft Windows Server
A critical vulnerability affecting Windows Server would allow an unauthenticated attacker to cause remote code execution on affected systems.
Description
Technical context and vulnerability details
Windows Server is a server operating system developed by Microsoft, designed to manage network infrastructure, directory services and application hosting in an enterprise. This system is affected by a vulnerability labeled CVE-2026-41089 which results from a stack-based buffer overflow within the Windows Netlogon service. Exploitation of this vulnerability would allow an unauthenticated attacker to send malicious requests over the network to execute arbitrary commands with elevated privileges on the target system. It is classified critical with a severity score of 9.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Compromise of system integrity;
- Breach of confidentiality and availability of data;
Affected systems
Products, components and targeted versions
- Windows Server 2012;
- Windows Server 2012 R2;
- Windows Server 2016 versions prior to 10.0.14393.9140;
- Windows Server 2019 versions prior to 10.0.17763.8755;
- Windows Server 2022 versions prior to 10.0.20348.5074;
- Windows Server 2022 23H2 versions prior to 10.0.25398.2330;
- Windows Server 2025 versions prior to 10.0.26100.32772;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Windows Server to its latest stable version;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.