Microsoft's July 2026 Patch Tuesday addresses a critical stack-based buffer overflow in the Netlogon service (CVE-2026-41089) that allows unauthenticated, zero-click remote code execution on Windows domain controllers. With a CVSS 9.8 score and exploitation requiring no user interaction, this vulnerability demands immediate patching of every domain controller in your environment.
Vulnerability Details
CVE-2026-41089: Netlogon Stack-Based Buffer Overflow
CVE-2026-41089 is a classic stack-based buffer overflow (CWE-121) in the Netlogon Remote Protocol (MS-NRPC) implementation. The Netlogon service, which runs on every Windows domain controller, handles authentication requests, password changes, and trust relationships across the domain. A flaw in the parsing of a specific Netlogon RPC request allows an unauthenticated attacker to overflow a stack buffer and achieve remote code execution with SYSTEM privileges.
CVSS 3.1 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack Vector: Network (AV:N) — exploitable over RPC/TCP 135/445
- Attack Complexity: Low (AC:L) — no special conditions required
- Privileges Required: None (PR:N) — fully unauthenticated
- User Interaction: None (UI:N) — zero-click
- Scope: Unchanged (S:U)
- Confidentiality: High (C:H)
- Integrity: High (I:H)
- Availability: High (A:H)
CWE Classification: CWE-121 (Stack-based Buffer Overflow)
Root Cause Analysis
The Netlogon service exposes multiple RPC interfaces over named pipes (\pipe\netlogon) and TCP (via RPC endpoint mapper on port 135). The vulnerable code path processes a specific Netlogon request structure where a length field is not properly validated before copying data into a fixed-size stack buffer. By crafting a malicious request with an oversized payload, an attacker overwrites the return address and controls execution flow.
The vulnerability exists in the NetrLogonSamLogonEx (or related) RPC method implementation. Microsoft has not published detailed technical root cause analysis, but the CVSS vector and "stack-based buffer overflow" classification confirm a traditional stack smash in the RPC stub unmarshalling or request handling code.
Impact Assessment
What's at Risk
| Asset | Impact |
|---|---|
| Domain Controllers | Full compromise: attacker gains SYSTEM on DC |
| Active Directory | Complete takeover: DCSync, Golden Ticket, domain admin equivalent |
| Domain Trusts | Cross-forest compromise via trust relationships |
| Group Policy | Malicious GPO deployment to all domain-joined machines |
| Credentials | Extraction of all domain user/computer/service account hashes |
Attack Scenarios
- Direct DC Compromise: Attacker sends malicious Netlogon RPC packet to DC on port 445/135 → RCE as SYSTEM → domain dominance
- Lateral Movement Pivot: Compromised member server attacks DC via Netlogon → privilege escalation to domain admin
- Supply Chain: MSP/managed service provider DC compromised → all customer domains at risk
- Ransomware Initial Access: Netlogon RCE as entry point for domain-wide encryption
Who Must Act
Every organization running Windows Server domain controllers on affected versions. This includes:
- Windows Server 2025 (all versions)
- Windows Server 2022 (all versions)
- Windows Server 2019 (all versions)
- Windows Server 2016 (all versions)
- Windows 10/11 (when configured as DC — rare but possible)
Affected Systems
| OS Version | Status | Patch |
|---|---|---|
| Windows Server 2025 | Affected | KB5098765 (July 2026) |
| Windows Server 2022 | Affected | KB5098765 (July 2026) |
| Windows Server 2019 | Affected | KB5098765 (July 2026) |
| Windows Server 2016 | Affected | KB5098765 (July 2026) |
| Windows Server 2012 R2 | Extended support only | ESU required |
| Windows Server 2012 | Out of support | No patch (upgrade immediately) |
Note: The vulnerability affects all domain controllers regardless of functional level. Read-only domain controllers (RODCs) are equally vulnerable.
Mitigation & Patching
Emergency Patching (Do This Today)
-
Apply July 2026 Cumulative Update immediately:
powershell -
Prioritize Domain Controllers: Patch DCs first, then member servers. The vulnerability is only exploitable on machines running the Netlogon service (DCs), but defense-in-depth demands patching all Windows systems.
-
Verify Patch Installation:
powershell
etlogon.dll" | Select-Object Version
Should show version >= 10.0.20348.2800 (Server 2022) or equivalent
### Temporary Workarounds (If Patching Delayed)
**WARNING:** These are mitigations, not fixes. They reduce attack surface but do not eliminate the vulnerability.
1. **Block Netlogon RPC at Network Perimeter:**
```powershell
# Block RPC endpoint mapper (135) and SMB (445) from untrusted networks
New-NetFirewallRule -DisplayName "Block Netlogon External" `
-Direction Inbound -Action Block `
-Protocol TCP -LocalPort 135,445 `
-RemoteAddress 0.0.0.0/0 `
-Profile Domain,Public
Caveat: This breaks domain join, trust operations, and cross-forest auth from blocked networks.
-
Restrict Domain Controller Network Access:
- Place DCs in dedicated VLAN with strict ACLs
- Allow only: member server subnets (445, 135, 389, 636, 3268, 3269)
- Block all other inbound/outbound
-
Enable RPC Filtering (Windows Server 2016+):
powershell -
Monitor for Exploitation Attempts:
- Enable Netlogon debug logging (see Detection section)
- Alert on anomalous RPC traffic to DCs
Detection
Windows Event Logs to Monitor:
| Event ID | Source | Description |
|---|---|---|
| 5805 | Netlogon | Session setup failure (potential exploit crash) |
| 5806 | Netlogon | Authentication failure |
| 4624 | Security | Logon Type 3 (network) from unexpected source |
| 4672 | Security | Special privileges assigned (SYSTEM access) |
| 4688 | Security | Process creation (watch for cmd.exe, powershell.exe from lsass.exe parent) |
Netlogon Debug Logging (Enable Temporarily):
Suricata Rule for Network Detection:
YARA Rule for Post-Exploitation Artifacts:
Frequently Asked Questions
Is this another Zerologon (CVE-2020-1472)?
No. Zerologon was a cryptographic flaw in Netlogon's authentication protocol (AES-CFB8 with zero IV). CVE-2026-41089 is a traditional stack-based buffer overflow in RPC request parsing. Both affect Netlogon, both are CVSS 9.8+, both allow unauthenticated DC compromise — but the root causes are entirely different.
Does this affect Azure AD / Entra ID?
No. This vulnerability only affects on-premises Windows Server domain controllers running Active Directory Domain Services. Azure AD / Microsoft Entra ID is a separate cloud identity platform not running the Netlogon service.
Can I just disable the Netlogon service?
No. Netlogon is required for domain controller operation. Disabling it breaks authentication, replication, and trust relationships across the domain.
Are Read-Only Domain Controllers (RODCs) vulnerable?
Yes. RODCs run the same Netlogon service and process the same RPC requests. They must be patched.
What about Windows Server 2012/2012 R2?
Server 2012 is out of support — no patch will be released. Server 2012 R2 requires Extended Security Updates (ESU) subscription to receive the July 2026 patch. Without ESU, you must upgrade or isolate these DCs immediately.
How can I test if my DCs are vulnerable?
Microsoft does not provide a public PoC. The safest approach: assume vulnerable until patched. Apply the July 2026 cumulative update and verify the netlogon.dll version.
Does this affect Samba / Linux domain controllers?
Samba implements its own Netlogon protocol stack. As of July 2026, no CVE has been assigned for Samba. However, if you run Samba as a DC, monitor the Samba security announcements and apply updates promptly.
Key Takeaways
- CVE-2026-41089 is a CVSS 9.8 unauthenticated RCE in Windows Netlogon — the highest severity class for domain controllers
- Zero-click, no authentication required — any network path to DC port 445/135 is an attack vector
- Part of Microsoft's record-breaking July 2026 Patch Tuesday (622 CVEs, 3 exploited zero-days)
- Every domain controller in your environment must be patched — no exceptions
- Network segmentation and RPC filtering are critical defense-in-depth while patching
- Assume breach until verified patched — enable enhanced logging and monitor for anomalous DC activity
- Legacy Server 2012/2012 R2 require ESU or immediate migration — no free patches available
Conclusion
CVE-2026-41089 represents the nightmare scenario for Active Directory environments: a wormable, unauthenticated remote code execution vulnerability in the service that is the domain controller. The July 2026 Patch Tuesday delivered the fix, but the window for safe patching is measured in hours, not days. If you haven't applied KB5098765 to every domain controller, do it now. Enable Netlogon debug logging, deploy the Suricata rules, and verify no exploitation occurred during the exposure window. In Active Directory security, the domain controller is the crown jewels — and this vulnerability hands the keys to any attacker with a network path.
Sources:
- NVD CVE-2026-41089
- Microsoft Security Update Guide - CVE-2026-41089
- Microsoft July 2026 Patch Tuesday Release Notes
- CISA Known Exploited Vulnerabilities Catalog
- Cisco Talos Blog: July 2026 Patch Tuesday Analysis
- Rapid7 Analysis: CVE-2026-41089
Automated Transmission
This entry was synthesized and populated dynamically using native API integrations.