PT-2026-40234 · Microsoft · Netlogon+1

Published 2026-05-12 · Updated 2026-05-22 · CVE-2026-41089

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Netlogon (affected versions not specified)

Description A stack-based buffer overflow exists in the Windows Netlogon service. This issue allows an unauthorized remote attacker to execute arbitrary code over a network without authentication or user interaction. Successful exploitation can grant the attacker SYSTEM privileges on domain controllers, potentially allowing them to pivot to other domain controllers, abuse authentication flaws to escalate privileges across enterprise networks, and move laterally through Azure services and Dynamics 365.

Recommendations Immediately apply the patches provided in the May 2026 Patch Tuesday update for all affected systems, prioritizing Domain Controllers.

Fix

RCE

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2026-06756

CVE-2026-41089

Affected Products

Netlogon

Windows

References · 29

• https://nvd.nist.gov/vuln/detail/CVE-2026-41089 · Security Note
• https://bdu.fstec.ru/vul/2026-06756 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-41089 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41089 · Security Note
• https://twitter.com/NoctisIntel/status/2054616877113176306 · Twitter Post
• https://twitter.com/aviatrixtrc/status/2054606921173180662 · Twitter Post
• https://reddit.com/r/TheSailor/comments/1te2adz/windows_dns_client_vulnerability_cve202641096 · Reddit Post
• https://twitter.com/rootxreacher/status/2055212418385727849 · Twitter Post
• https://twitter.com/SecurityAr58409/status/2054609003288592800 · Twitter Post
• https://canto.today/en/p/microsoft-patches-critical-netlogon-flaw-4s10r4 · Reddit Post
• https://twitter.com/CyberTLDR/status/2054708650858422680 · Twitter Post
• https://twitter.com/threadlinqs/status/2054411738330669106 · Twitter Post
• https://reddit.com/r/Automox/comments/1tbczuc/may_2026_patch_tuesday_breakdown_two_preauth_98 · Reddit Post
• https://twitter.com/vuldb/status/2054262643196821818 · Twitter Post