CVE Intelligence
Analysis AI-assisted

CVE-2026-41089: Microsoft Windows Netlogon Remote Code Execution

Microsoft's record describes a stack-based buffer overflow (CWE-121) in Windows Netlogon that allows an unauthorized attacker to execute code over a network, with a CVSS base score of 9.8 (critical). The record lists CISA KEV as not listed and no exploitation status beyond SSVC 'none', so no confirmed exploitation appears in the sources consulted. The record does not include a fixed-version field, so the patched builds described here are derived from the affected version ranges and the linked vendor advisory should be checked for authoritative details.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes a stack-based buffer overflow (CWE-121) in Windows Netlogon. According to the description, an unauthorized attacker could execute code over a network. The record was published on 2026-05-12 with Microsoft as the CNA and links to the MSRC update guide entry.

Impact

  • The record states that successful exploitation would allow an unauthorized attacker to execute code over a network.
  • The CVSS base score in the record is 9.8 (critical), which reflects network attack vector, low complexity, no privileges and no user interaction.
  • The SSVC data in the record lists technical impact as total and automatable as yes.

Affected products and versions

The record lists Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including the Server Core installations. The ranges below are written as the record presents them:

  • Windows Server 2012: from 6.2.9200.0 up to before 6.2.9200.26079. The record also lists an entry for this product whose version is not specified by the source.
  • Windows Server 2012 R2: from 6.3.9600.0 up to before 6.3.9600.23181.
  • Windows Server 2016: before 10.0.14393.9140, and from 10.0.14393.0 up to before 10.0.14393.9140.
  • Windows Server 2019: before 10.0.17763.8755, and from 10.0.17763.0 up to before 10.0.17763.8755.
  • Windows Server 2022: before 10.0.20348.5074, and from 10.0.20348.0 up to before 10.0.20348.5139.
  • Windows Server 2022 23H2 entry: before 10.0.25398.2330. The Server Core variant is listed from 10.0.25398.0 up to before 10.0.25398.2330.
  • Windows Server 2025: before 10.0.26100.32772, and from 10.0.26100.0 up to before 10.0.26100.32860.

The record includes no fixed-version field, so the thresholds above should be read as the boundaries given by the source, not as a confirmed list of patched builds.

Exploitation status

The record shows CISA KEV as not listed, so this analysis does not describe active exploitation. No confirmed exploitation appears in the sources consulted. The record gives an EPSS probability of 0.00974 and a percentile of 0.61728, and an SSVC exploitation value of none.

Remediation and mitigation

  • Review the vendor advisory linked in the record, MSRC update guide entry for CVE-2026-41089, and apply the security update applicable to each affected edition.
  • Inventory Windows Server hosts by product edition and build number, and compare them with the ranges above to find systems below the stated thresholds.
  • Prioritize servers that run the Netlogon service and are reachable from less trusted network segments, since the record describes network exploitation.
  • The record does not describe workarounds. Any interim measure should be validated with the vendor guidance before being applied.

Detection guidance

  • Track build numbers of Windows Server systems to confirm that the update has been applied across the estate.
  • Monitor for unexpected crashes, restarts or abnormal behavior of the Netlogon service on servers.
  • Review network telemetry for unusual Netlogon traffic originating from untrusted segments, and correlate with authentication logs.

Limitations of the available information

  • The record contains no fixed-version field, so patched builds are not confirmed beyond the affected ranges.
  • The record includes one affected entry whose version is not specified by the source.
  • Two overlapping thresholds are listed for Windows Server 2022 and Windows Server 2025, and their intended meaning is not explained in the record.
  • No exploit details, proof-of-concept information or workarounds are included in the record.
  • The EPSS data and the SSVC values come from the record and were not independently verified here.

Frequently asked questions

What does CVE-2026-41089 affect?

The record lists Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. The affected ranges are given in the body of this analysis as the source presents them.

Is this vulnerability being actively exploited?

The record shows the vulnerability is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation value in the record is none.

What should administrators do first?

Review the Microsoft advisory linked in the record, inventory Windows Server builds against the stated thresholds, and apply the applicable security update. The record does not describe workarounds.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.