Description
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.
Published: 2026-05-12
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A stack‑based buffer overflow in the Windows Netlogon service allows an attacker who is not authenticated to execute arbitrary code on the target server over the network.

Affected Systems

Microsoft Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022 (including the 23H2 edition), and Windows Server 2025, including their Server Core installations on 64‑bit builds. Specific version numbers are not listed in the vulnerability advisory; only the vendor and product names are provided.

Risk and Exploitability

The CVSS base score of 9.8 classifies the vulnerability as critical, and the EPSS value of <1% indicates that the likelihood of active exploitation is very low. It is not listed in the CISA KEV catalog. Attackers must be able to reach the vulnerable Netlogon service on the target server; once the stack overflow is triggered, arbitrary code execution is possible. The combination of a critical severity score and a very low exploitation probability underscores the need for rapid remediation.

Generated by OpenCVE AI on September 24, 2026 at 21:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Microsoft security update for CVE‑2026‑41089 by following the instructions in the Microsoft Security Response Center update guide.
  • Restrict inbound traffic to the Netlogon service using firewalls or network segmentation so that only trusted hosts can communicate with the service.
  • If the Netlogon service is not required on a machine, disable it to eliminate exposure.

Generated by OpenCVE AI on September 24, 2026 at 21:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 15 May 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows Server 2022 23h2
CPEs cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
Vendors & Products Microsoft windows Server 2022 23h2

Wed, 13 May 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 12 May 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows Server 2012 (server Core Installation)
Microsoft windows Server 2012 R2
Microsoft windows Server 2012 R2 (server Core Installation)
Microsoft windows Server 2016 (server Core Installation)
Microsoft windows Server 2019 (server Core Installation)
Microsoft windows Server 2022, 23h2 Edition (server Core Installation)
Microsoft windows Server 2025 (server Core Installation)
Vendors & Products Microsoft windows Server 2012 (server Core Installation)
Microsoft windows Server 2012 R2
Microsoft windows Server 2012 R2 (server Core Installation)
Microsoft windows Server 2016 (server Core Installation)
Microsoft windows Server 2019 (server Core Installation)
Microsoft windows Server 2022, 23h2 Edition (server Core Installation)
Microsoft windows Server 2025 (server Core Installation)

Tue, 12 May 2026 17:30:00 +0000

Type Values Removed Values Added
Description Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.
Title Windows Netlogon Remote Code Execution Vulnerability
First Time appeared Microsoft
Microsoft windows Server 2012
Microsoft windows Server 2012 R2
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
Microsoft windows Server 23h2
Weaknesses CWE-121
CPEs cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_23h2:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows Server 2012
Microsoft windows Server 2012 R2
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
Microsoft windows Server 23h2
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Windows Server 2012 Windows Server 2012 (server Core Installation) Windows Server 2012 R2 Windows Server 2012 R2 Windows Server 2012 R2 (server Core Installation) Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 Windows Server 2019 (server Core Installation) Windows Server 2022 Windows Server 2022, 23h2 Edition (server Core Installation) Windows Server 2022 23h2 Windows Server 2025 Windows Server 2025 (server Core Installation) Windows Server 23h2
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-08-10T15:12:59.779Z

Reserved: 2026-04-16T19:12:36.194Z

Link: CVE-2026-41089

cve-icon Vulnrichment

Updated: 2026-05-13T10:00:40.722Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-12T18:17:20.720

Modified: 2026-06-17T10:46:09.190

Link: CVE-2026-41089

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T21:45:17Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow