Critical — Active Exploitation Confirmed

CVE-2026-41089
Windows Netlogon RCE

Unauthenticated Remote Code Execution on Active Directory Domain Controllers via stack-based buffer overflow in the Netlogon service.

Platform: Windows Server Severity: Critical CVSS 9.8 / 10 Attack Vector: Network Privileges: None

Download PoC Scanner View on GitHub

CVSS Score

Auth Required

Buffer Bytes

UDP Port

// Conceptual Overview

🧠 What Is CVE-2026-41089?

A technical breakdown of an exceptionally critical vulnerability residing deep within the Windows Netlogon service. The flaw is rooted in a severe stack-based buffer overflow (CWE-121). By sending specially crafted CLDAP requests to a vulnerable Domain Controller, an unauthenticated attacker can force memory corruption and potentially execute arbitrary code at SYSTEM level.

"He who controls Netlogon, controls the kingdom."

Zero user interaction. Zero prior authentication. A direct, frictionless path to complete Active Directory compromise — a prime target for APTs and ransomware syndicates.

// Vulnerability Specifications

📊 Technical Details

CVE Identifier

CVE-2026-41089

Officially tracked — May 2026 Patch Tuesday

Severity Score

Critical — CVSS 9.8

Vulnerability Type

CWE-121

Stack-based Buffer Overflow

Affected Component

netlogon.dll

NetpLogonPutUnicodeString — CLDAP handler

Attack Vector

Network / UDP 389

Fully remote, unauthenticated CLDAP ping

Privileges Required

None

Unauthenticated — no credentials needed

// Attack Scenario

🕸️ Attack Path Architecture

From any foothold on the internal network, the path to domain compromise is dangerously short:

1 · Unauthenticated Attacker Network access to internal VLAN — no credentials required

2 · Locate Domain Controller DNS SRV records, LDAP, or subnet scanning for UDP/TCP 389

3 · Crafted CLDAP Packet Oversized User field + NtVer legacy path → netlogon.dll

4 · Stack Buffer Overflow 528-byte stack buffer exceeded → memory corruption in LSASS

5 · Arbitrary Code Execution SYSTEM-level privileges on the Domain Controller

6 · Full AD Compromise NTDS.dit access, Golden Tickets, lateral movement across the estate

💡 Why This Matters

Domain Takeover: Immediate escalation to Domain Admin privileges.
Credential Harvesting: Direct access to the NTDS.dit database.
Lateral Movement: Unfettered access to all domain-joined endpoints.
Persistence: Golden Tickets, shadow credentials, rogue DC injection.

// Quick Start Guide

🚀 PoC Usage

Python-based diagnostic script to test domain controllers for susceptibility to the Netlogon CLDAP overflow. Use only on systems you own or have written authorization to test.

bash — terminal

# 1. Safe connectivity check (short username, no overflow)
python3 CVE-2026-41089.py 10.0.50.21 corp.local -l 10

# 2. Default vulnerability check (300 chars, overflows 528-byte buffer)
python3 CVE-2026-41089.py 10.0.50.21 corp.local

# 3. Custom payload with legacy NtVer and extended timeout
python3 CVE-2026-41089.py 10.0.50.21 corp.local -l 300 -n 0x02000000 -t 10

// Threat Hunting

🛡️ Detection & IoCs

Monitor the following high-fidelity indicators in your environment:

[!] Unexpected Netlogon service crashes or spontaneous DC restarts
[!] Event ID 1000 — lsass.exe faulting module netlogon.dll, exception 0xc0000409
[!] Abnormal process spawning directly from lsass.exe
[!] Spikes in malformed CLDAP requests on UDP port 389
[!] Unrecognized authentication anomalies in Windows Event Logs
[!] Suspicious RPC traffic directed at Domain Controllers

📈 Recommended Log Sources

Windows Security & Application Event Logs (service crashes, logon failures)
Microsoft Defender for Identity / Defender for Endpoint
Sysmon — Process Creation & Network Connections
SIEM alerting rules for DC RPC/CLDAP traffic anomalies

// Mitigation Strategy

🛠️ Immediate Actions

Apply Microsoft Patches: Install May 2026 Patch Tuesday updates on all Domain Controllers immediately.
Restrict Network Access: Limit UDP 389 / Netlogon RPC to authorized subnets via firewall rules.
Enable EDR Visibility: Apply aggressive monitoring policies to the lsass.exe process.
Validate AD Integrity: Audit Domain Admin groups and check for shadow credentials.
Verify Patch Status: Compare netlogon.dll hash and KB installation across all DCs.

// License & Legal

⚖️ Disclaimer

This vulnerability analysis and associated PoC code are provided for authorized defensive research and system administration only. Exploiting CVE-2026-41089 on systems or networks without explicit, written authorization is strictly illegal. The author assumes no liability for any misuse of this information. Ransomware deployment, unauthorized lateral movement, and Active Directory manipulation carry severe legal consequences. Always patch early and test responsibly in isolated laboratory environments.