/00 — boot sequence

Hello.

aiyu
← Back to Blogs

Article

Windows Netlogon Zero-Click RCE: CVE-2026-41089 Actively Exploited

July 16, 2026•6 min read
windows netlogon cve-2026-41089 vulnerability active-directory rce

Introduction

Microsoft's May 2026 Patch Tuesday addressed CVE-2026-41089, a critical Windows Netlogon remote code execution vulnerability with a CVSS 3.1 score of 9.8. Initially assessed by Microsoft as "exploitation less likely," the flaw is now actively exploited in the wild according to the Centre for Cybersecurity Belgium (CCB) and multiple security vendors. This zero-click, pre-authentication RCE targets Active Directory domain controllers via a stack-based buffer overflow in the Netlogon service's DC locator response handler. Any organization running unpatched Windows domain controllers with long DNS domain names is at immediate risk.

Vulnerability Details

CVSS Metrics

  • CVSS 3.1 Score: 9.8 (Critical)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
  • Attack Vector: Network (UDP port 389 / CLDAP)
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Impact: High confidentiality, integrity, and availability

CWE Classification

  • Primary: CWE-121 (Stack-based Buffer Overflow)
  • Related: CWE-120 (Buffer Copy without Checking Size of Input)

Affected Products

All supported Windows Server versions configured as Active Directory domain controllers:

  • Windows Server 2025 (Server Core)
  • Windows Server 2022 (Server Core)
  • Windows Server 2019 (Server Core)
  • Windows Server 2016 (Server Core)
  • Windows 11 versions 24H2, 23H2
  • Windows 10 versions 22H2, 21H2, 1809, 1607

Key constraint: Only domain controllers are vulnerable. The Netlogon DC locator ping handler (BuildSamLogonResponse) is only active when the system holds the DC role. Member servers and workstations running the same netlogon.dll are not exploitable via this path.

Impact Assessment

What's at Risk

A successful exploit crashes the LSASS process (Local Security Authority Subsystem Service) on the domain controller, forcing an immediate system reboot. Since LSASS hosts all authentication services — Kerberos, NTLM, and Netlogon secure channel — its crash denies authentication to the entire Active Directory domain until the DC reboots (approximately 60 seconds).

Attack Characteristics

  • Zero-click: No user interaction required
  • Pre-authentication: Attacker needs zero credentials
  • Single packet: One crafted CLDAP UDP packet triggers the crash
  • Target: Domain controllers with long DNS domain names (50+ characters)
  • Entry point: UDP port 389 (CLDAP / Connectionless LDAP)

The "Long Domain Name" Condition

The vulnerability is conditional on the target DC's DNS domain name length. Aretiq's analysis shows:

  • Short domains (e.g., example.com, ~11 chars): Not vulnerable — total response fits in 528-byte buffer
  • Long domains (e.g., dept.division.engineering.enterprise.corporation.local, 54 chars): Vulnerable — DNS name data overflows buffer

The attacker controls the overflow length (via username up to 130 wide characters = 260 bytes) but not the overflow content (server's own DNS names). This makes reliable RCE beyond DoS unlikely — the overflow corrupts the GS stack cookie, triggering __fastfail(FAST_FAIL_STACK_COOKIE_CHECK_FAILURE) and terminating LSASS, but cannot reach the return address (72 bytes past buffer end; max overflow ~51 bytes).

Affected Systems

Who Needs to Act Immediately

Any organization with:

  1. Active Directory domain controllers running unpatched Windows Server (pre-May 2026)
  2. DNS domain names exceeding ~50 characters in combined FQDN length
  3. UDP port 389 accessible from untrusted networks (internet-facing or laterally exposed DCs)

Systems Not Affected

  • Non-DC servers (member servers, standalone)
  • DCs with short DNS domain names
  • Systems patched with May 2026 security updates (KB5089549 or later)

Mitigation & Patching

Primary Fix: Apply May 2026 Security Updates

PlatformPatch KB
Windows Server 2025KB5089549
Windows Server 2022KB5089549
Windows Server 2019KB5089549
Windows Server 2016KB5089549
Windows 11 24H2/23H2KB5089549
Windows 10 22H2/21H2/1809/1607KB5089549

Critical guidance from Jason Kikta (Automox CTO): "Patch the flaw on all domain controllers in the same maintenance window. Half-patched forests are not a defensible state for a pre-auth DC bug."

Legacy System Protection (0patch Micropatches)

Acros Security released micropatches for unsupported Windows versions:

  • Windows Server 2008 R2
  • Windows Server 2012
  • Windows Server 2012 R2

Available via 0patch.com — no reboot required for micropatch injection.

Network-Level Mitigations

  1. Block UDP 389 at perimeter — Prevent internet-facing CLDAP exposure
  2. Restrict CLDAP to trusted subnets — Domain controllers should only accept CLDAP from known management networks
  3. Disable CLDAP if unused — Set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\LdapSrvPriority to 0
  4. Enable LDAP signing and channel binding — Hardens Netlogon secure channel

Detection Rules

Suricata Network Signatures

The following Suricata rules detect CLDAP DC locator pings with oversized User attributes (indicative of the exploit) and CLDAP packets using the non-EX NtVer=2 path required for the vulnerability:

yaml

YARA Host-Based Detection

yara

Detection

Host Indicators of Compromise

Monitor domain controllers for:

  1. Event ID 1000 (Application Error) — lsass.exe crash with exception 0xc0000409 (STATUS_STACK_BUFFER_OVERRUN)
  2. Event ID 41 (Kernel-Power) — Unexpected reboot following LSASS crash
  3. Netlogon service restarts — Unexplained Netlogon service crashes
  4. CLDAP traffic anomalies — UDP 389 packets with oversized User attribute (>100 bytes)

Application Event Log Example

Faulting application name: lsass.exe Faulting module name: netlogon.DLL Exception code: 0xc0000409 Fault offset: 0x000000000002399d Faulting process id: 0x31C

Frequently Asked Questions

Is this vulnerability wormable?

No. The overflow corrupts the GS stack cookie, causing LSASS to terminate immediately. The overflow content is server-controlled DNS data, not attacker-controlled shellcode. RCE beyond DoS is theoretically possible but practically unlikely due to the 21-byte gap to the return address and stack cookie protection.

Do I need to patch if my domain name is short?

Yes. While short domain names prevent the current exploit path, future research could find alternative trigger conditions. Defense in depth requires patching regardless of current exploitability.

Can I just block UDP 389 instead of patching?

Blocking UDP 389 is a valid compensating control but not a substitute for patching. Lateral movement within a compromised network can still reach DCs. Apply the patch AND restrict CLDAP exposure.

What about read-only domain controllers (RODCs)?

RODCs running the DC role are equally vulnerable. Apply the same patches.

Does this affect Azure AD / Entra ID?

No. This vulnerability affects on-premises Active Directory domain controllers only. Cloud identity providers are not affected.

How can I verify the patch is applied?

Check for KB5089549 (or later cumulative update) in Installed Updates. Verify netlogon.dll file version is 10.0.26100.32684 or newer (Server 2025). Use the YARA rule CVE_2026_41089_Netlogon_Patched to confirm Feature_404993339 and RtlStringCbCopyExW are present.

Key Takeaways

  1. CVE-2026-41089 is actively exploited — CCB confirmed in-the-wild attacks as of June 2026
  2. CVSS 9.8, zero-click, pre-auth RCE — Maximum severity for a domain controller vulnerability
  3. Conditional on long DNS domain names — ~50+ characters required for overflow to reach stack cookie
  4. Impact is DoS (LSASS crash + DC reboot), not reliable RCE — but domain-wide auth denial is severe
  5. Patch immediately — Apply May 2026 updates to all DCs in the same maintenance window
  6. Legacy systems covered by 0patch — Server 2008 R2, 2012, 2012 R2 get micropatches
  7. Network controls are essential — Block/restrict UDP 389, enable LDAP signing

Conclusion

CVE-2026-41089 demonstrates how AI-accelerated vulnerability research is shrinking the window between disclosure and exploitation. Microsoft's initial "exploitation less likely" assessment was overturned within weeks as researchers reverse-engineered the patch and threat actors weaponized the flaw. For Active Directory environments, this is a textbook case of why pre-authentication DC vulnerabilities demand immediate, coordinated patching across the entire forest — half-measures leave the door open for domain-wide compromise.

Sources

Automated Transmission

This entry was synthesized and populated dynamically using native API integrations.

Resources & Links