CVE-2026-41089: critical Windows Netlogon RCE flaw

CVE-2026-41089 is a critical Windows Netlogon vulnerability affecting domain controllers. An unauthenticated attacker can send crafted network packets and achieve code execution as SYSTEM. The issue has a CVSS 9.8 score, and incident-response organisations report active exploitation.

Those facts justify emergency handling for Active Directory teams. They do not justify the unofficial name “Zerologon 2”, attribution to a particular actor or automatic connection to ransomware; available advisories do not establish those claims.

How CVE-2026-41089 works

According to CERT-EU, the flaw is a stack-based buffer overflow in Windows Netlogon. It requires no prior account or user action. The target must be a Windows server acting as a domain controller, where crafted traffic can cause code execution as SYSTEM.

SYSTEM is the highest local Windows privilege. On a domain controller, successful exploitation affects a system central to user and computer authentication. It does not mean every affected controller was compromised, but potential impact is severe.

Microsoft published fixes in the Security Update Guide, and the Centre for Cybersecurity Belgium updated its advisory to indicate active exploitation.

Affected systems

The scope includes supported and extended-support Windows Server versions used as domain controllers:

• Windows Server 2012 and 2012 R2;
• Windows Server 2016;
• Windows Server 2019;
• Windows Server 2022, including 23H2;
• Windows Server 2025.

Required build thresholds depend on the release. Verify the correct package and installed state in Microsoft’s table. Inventory branch-office controllers, disaster-recovery environments, legacy domains, connected labs and extended-support servers—not only the obvious production pair.

Why domain-controller role changes priority

A domain controller processes authentication and trust relationships for many services. SYSTEM execution there is not equivalent to compromising one workstation. Patch ahead of ordinary lower-value server windows while preserving domain availability.

Test on a representative controller, confirm replication and health, then deploy in stages so at least one healthy controller remains available for each domain and location. Broader defensive layers are covered in our Active Directory security guide.

Administrator action plan

1. Inventory every domain controller with OS, build, location and owner.
2. Obtain the correct Microsoft update for each branch.
3. Patch urgently without updating all controllers simultaneously.
4. After restart, verify build level, Netlogon, AD replication, DNS and system events.
5. Restrict network routes to controllers. They must not be internet-accessible or reachable from every user segment.
6. Document verified results rather than recording only that a deployment job was sent.

Patching does not close incident analysis

If a controller was reachable from an untrusted network while unpatched during active exploitation, installation alone cannot answer whether it was attacked. Preserve and review domain-controller, firewall, EDR and authentication logs.

Look for temporally related unknown processes, services and tasks, privileged account changes, disabled controls or unexpected outbound connections. No single signal automatically proves use of this CVE, but anomalies can justify a full incident response.

CVE-2026-41089 combines unauthenticated network attack, SYSTEM execution on a domain controller and active exploitation. Patch all relevant Windows Server 2012/2012 R2 through 2025 controllers, validate replication and investigate exposed systems without adding unsupported campaign claims.

---

Sources: Microsoft MSRC, Centre for Cybersecurity Belgium, CERT-EU 2026-007.