Windows Netlogon Stack Buffer Overflow RCE (CVE-2026-41089) | MSSP Advisory

A critical Windows Netlogon vulnerability (CVE-2026-41089) is now actively exploited in the wild according to Belgium's national cybersecurity authority. The stack-based buffer overflow allows unauthenticated attackers to achieve remote code execution on domain controllers by sending crafted network requests. Microsoft patched this flaw in May 2026 Patch Tuesday, but active exploitation confirms attackers have weaponized it.

Domain controllers are the crown jewels of your client networks and your own internal infrastructure. If attackers compromise a domain controller through this Netlogon flaw, they own the entire Active Directory environment, including every endpoint your RMM touches and every credential your PSA stores. Your clients expect you to know about critical domain controller threats the day exploitation begins, not when their network is already compromised.