Remote code execution affecting Netlogon
A vulnerability affecting the Microsoft Windows Netlogon service would allow an unauthenticated attacker to remotely execute arbitrary code on affected systems.
Description
Technical context and vulnerability details
Netlogon is a critical authentication service built into Microsoft Windows Server operating systems. It is responsible for maintaining a secure communication channel between workstations, servers and the domain controller within an Active Directory infrastructure. This service is affected by a vulnerability labeled CVE-2026-41089, resulting from a stack-based buffer overflow. Exploitation of this vulnerability would allow an unauthenticated malicious actor to send specially crafted RPC requests to a domain controller leading to remote arbitrary code execution with Netlogon service privileges. It is classified critical with a severity score of 9.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Denial of service affecting the authentication service;
- Data privacy breach;
- Compromise of system integrity;
Affected systems
Products, components and targeted versions
- Windows Server 2012 and 2012 R2 version 6.2.9200.0;
- Windows Server 2016 version 10.0.14393.0;
- Windows Server 2019 version 10.0.17763.0;
- Windows Server 2022 and 2022_23H2 version 10.0.20348.0;
- Windows Server 2025 version 10.0.26100.0;
RECOMMENDED ACTIONS:
- Urgently apply security patches published by Microsoft to all exposed domain controllers and servers;
- Restrict network flows to domain controllers to only legitimate IP addresses and subnets;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.