Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2026-41089 EUVD-2026-29681GHSA-7j2c-v44v-wc8f

Windows Netlogon Remote Code Execution Vulnerability

Published May 12, 2026 · Updated Aug 10, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Windows Server 2012 Product: Windows Server 2012 (Server Core installation) Product: Windows Server 2012 R2 Product: Windows Server 2012 R2 (Server Core installation) Product: Windows Server 2016 Product: Windows Server 2016 (Server Core installation) Product: Windows Server 2019 Product: Windows Server 2019 (Server Core installation) Product: Windows Server 2022 Product: Windows Server 2022, 23H2 Edition (Server Core installation) Product: Windows Server 2025 Product: Windows Server 2025 (Server Core installation) Platform: Windows

Description

Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

Affected products

VendorProductAffectedFixed
Microsoft Windows Server 2012 6.2.9200.0 – < 6.2.9200.26079 6.2.9200.26079
Microsoft Windows Server 2012 (Server Core installation) 6.2.9200.0 – < 6.2.9200.26079 6.2.9200.26079
Microsoft Windows Server 2012 R2 6.3.9600.0 – < 6.3.9600.23181 6.3.9600.23181
Microsoft Windows Server 2012 R2 (Server Core installation) 6.3.9600.0 – < 6.3.9600.23181 6.3.9600.23181
Microsoft Windows Server 2016 10.0.14393.0 – < 10.0.14393.9140 10.0.14393.9140
Microsoft Windows Server 2016 (Server Core installation) 10.0.14393.0 – < 10.0.14393.9140 10.0.14393.9140
Microsoft Windows Server 2019 10.0.17763.0 – < 10.0.17763.8755 10.0.17763.8755
Microsoft Windows Server 2019 (Server Core installation) 10.0.17763.0 – < 10.0.17763.8755 10.0.17763.8755
Microsoft Windows Server 2022 10.0.20348.0 – < 10.0.20348.5139 10.0.20348.5139
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.0 – < 10.0.25398.2330 10.0.25398.2330
Microsoft Windows Server 2025 10.0.26100.0 – < 10.0.26100.32860 10.0.26100.32860
Microsoft Windows Server 2025 (Server Core installation) 10.0.26100.0 – < 10.0.26100.32860 10.0.26100.32860

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 6 repositories

  • 0xABCD01/CVE-2026-41089 ★ 234 · Jun 1, 2026

    Netlogon and CLDAP vulnerability research with a proof of concept.

  • SyntaxMethod/CVE-2026-41089-Netlogon-RCE-PoC ★ 32 · Sep 11, 2026

    CVE-2026-41089 Netlogon RCE PoC — security research, vulnerability validation & defensive testing.

  • ADScanPro/CVE-2026-41089-LongLogon ★ 16 · Jun 3, 2026

    CVE-2026-41089 checker: unauthenticated, non-destructive detection for the Netlogon CLDAP stack buffer overflow (CVSS 9.8). Reports whether a domain controller's domain is long enough to crash, witho…

  • ashrafzaryouh/CVE-2026-41089 ★ 10 · Jun 2, 2026

    CVE-2026-41089

  • 1posix/CVE-2026-41089-PoC ★ 0 · Sep 26, 2026

    CVE-2026-41089 LongLogon: pre-auth CLDAP (UDP/389) stack buffer overflow crasher for unpatched Windows Server 2025 Netlogon (lsass 0xc0000409). Stdlib-only Python PoC + lab write-up.

  • Gillarchnganasan2735/CVE-2026-41089-Netlogon-RCE-PoC ★ 0 · Sep 21, 2026

    Automate Netlogon CVE-2026-41089 validation and defensive testing through integrated AI security workflows, enabling rapid risk assessment and mitigation verification.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 3

References