CVE-2026-41089

Published May 12, 2026

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-41089 is identified as a stack-based buffer overflow vulnerability affecting Windows Netlogon, a service and protocol crucial for authentication and security within a Windows domain environment. This flaw can be exploited by an attacker who sends a specially crafted network request to a Windows server functioning as a domain controller. Successful exploitation of CVE-2026-41089 could allow an unauthorized attacker to execute code over a network without requiring prior authentication or access. Microsoft disclosed and provided patches for this vulnerability on May 12, 2026, acknowledging its Windows Attack Research & Protection (WARP) team for the discovery. The Centre for Cybersecurity Belgium (CCB) has since issued warnings about active exploitation of this vulnerability in the wild.

Description: Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.
Source: secure@microsoft.com
NVD status: Analyzed
Products: windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022, windows_server_2022_23h2, windows_server_2025

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

secure@microsoft.com: CWE-121

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
            "matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "71D026B8-B196-4369-9AB3-5FCA21E8AA36",
            "versionEndExcluding": "10.0.14393.9140",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "C1926806-B15D-4AF1-967A-7ADA71FF74DC",
            "versionEndExcluding": "10.0.17763.8755",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "10060868-96D5-47E4-8FEB-80A79DCC1134",
            "versionEndExcluding": "10.0.20348.5074",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E3F26150-16EA-4D34-8BE9-2EE7C745D707",
            "versionEndExcluding": "10.0.25398.2330",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "9ABAB3B9-28AF-4278-8E78-E1191B1AFC0C",
            "versionEndExcluding": "10.0.26100.32772",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.