CVE-2026-41089: How One Netlogon Packet Can Take Down Your Entire AD

The TCS office ID-card panel — a story you already know

You work at the TCS Bengaluru office. Every morning when Sneha swipes her ID card on the entry panel, a silent conversation happens. The panel asks the central security system: "is this Sneha, is she still on payroll, what floors can she enter?" The central system answers in milliseconds. Sneha never sees the conversation. It just works — 50,000 times a day, across every door.

Now imagine someone walks up to the panel itself, jams a thin metal pin into a specific slot, and the panel responds by handing them the master key to every door in the building. They did not pretend to be Sneha. They did not steal her card. They just exploited the panel's own firmware. That is CVE-2026-41089. The panel is your domain controller. The silent conversation is Netlogon. The master key is full SYSTEM on every machine your AD touches.

Why this matters — in 10 seconds and in a paycheck

If you are sitting in an interview next week, this is the question. "A CVE dropped this month rated 9.8 against Windows DCs. Tell me what it does, how you would detect it, and what you would patch first." Get the answer wrong and the panel moves on. Get it right and you have separated yourself from every candidate who memorised buzzwords without learning the protocol underneath.

Why does the security industry care so much? Because compromising a domain controller is compromising the domain itself. A DC holds the NTDS.dit credential database, the Kerberos signing key (krbtgt), and the trust relationships with every member server and workstation. One DC down = every server, every desktop, every laptop, every cloud-joined identity, every Exchange mailbox — all yours.

What Netlogon actually is — the core concept

Netlogon is the Windows Remote Procedure Call (RPC) service that handles three quiet jobs:

• User logon authentication — when Rahul logs into his TCS laptop, his workstation does not talk to AD with his password. It hands the password to its Netlogon client, which runs an encrypted challenge-response over the MS-NRPC protocol against a DC.
• Machine-account password rotation — every domain-joined PC has a machine account whose password rotates every 30 days. Netlogon is what rotates it.
• DC-to-DC replication trust — when two DCs need to verify each other before replicating Active Directory data, they shake hands over Netlogon's secure channel.

Critically, the Netlogon service runs inside lsass.exe on every DC, and lsass.exe runs as NT AUTHORITY\SYSTEM. That is the privilege the bug hands to the attacker. Not Administrator. SYSTEM. On the DC.

How CVE-2026-41089 actually fires

The bug is a stack-based buffer overflow in Netlogon's message-handling code. Netlogon writes attacker-controlled bytes into a fixed-size stack buffer without checking the length. Because the buffer sits on the stack, the overflow can overwrite the function's saved return address. The attacker chooses what that overwritten return address points to — typically into a small payload they embedded earlier in the same packet, or into a ROP chain made of existing Netlogon code gadgets. Either way, execution lands wherever the attacker chose, running as SYSTEM, inside the Netlogon service.

What is unusual here is the pre-authentication property. The attacker does not need a domain user account. They do not need to be on the AD-joined LAN. They just need TCP/UDP reachability to the DC's RPC endpoint mapper on port 135 and the dynamic high port Netlogon negotiates afterwards. In a flat enterprise LAN — and most Indian enterprise networks are flatter than the architects admit — that means any compromised workstation can pivot to DC SYSTEM in one packet.

How CVE-2026-41089 is different from ZeroLogon (and why both still matter)

If you have done CISSP prep, you remember ZeroLogon (CVE-2020-1472). Both bugs end in "attacker owns the domain via Netlogon," but the root cause and the detection signal are very different. An interviewer will absolutely ask you to distinguish them.

Hands-on — is your DC vulnerable?

Three checks. Run them on each DC, in order. All commands run in an elevated PowerShell.

Check 1 — is the May 2026 patch installed?

Get-HotFix -Id KB5058411, KB5058385 |
    Select-Object HotFixID, InstalledOn, InstalledBy

HotFixID    InstalledOn   InstalledBy
--------    -----------   -----------
KB5058411   5/13/2026     NT AUTHORITY\SYSTEM
KB5058385   5/13/2026     NT AUTHORITY\SYSTEM

Check 2 — what build are we on?

Get-ComputerInfo -Property OsName, OsVersion, OsBuildNumber, OsHardwareAbstractionLayer
# Server 2022 fixed build: 20348.3517 or higher
# Server 2025 fixed build: 26100.3915 or higher

Check 3 — is Netlogon's RPC endpoint reachable from places it shouldn't be?

Test-NetConnection -ComputerName 10.42.50.10 -Port 135
# If TcpTestSucceeded = True from a user VLAN, your DC's RPC interface
# is exposed to every workstation. That is the attack surface.

Patch deployment — the order that does not break replication

1. Snapshot every DC (VM checkpoint or backup) before any reboot. If anything goes sideways with the secure channel, you want a rollback point.
2. Patch the PDC Emulator FSMO holder LAST, not first. The PDC Emulator is the time source and password-change authority — if it goes down mid-patch, every other DC's clock skews and Kerberos breaks.
3. Patch in this order: replica DCs in the largest site first → replica DCs in branch sites → finally the PDC Emulator. One DC at a time per site. Wait for replication to converge (repadmin /showrepl) between each.
4. After each DC reboots, verify the secure channel still works: Test-ComputerSecureChannel -Verbose on a member server in the same site. Expected: True.
5. Re-test reachability + Get-HotFix from step 1.

Detection — catching exploitation in Splunk + Microsoft Sentinel

Patching is half the job. Until every DC is patched (and even after), you want a detection that fires on the pre-exploit pattern: malformed MS-NRPC packets + unexpected Netlogon service crashes. Enable enhanced Netlogon logging first.

nltest /dbflag:0x2080FFFF
# Logs to %WINDIR%\debug\netlogon.log
# Look for Event IDs 5805, 5827, 5828, 5829, 5830, 5831

Splunk SPL — burst of malformed NRPC from a single source

index=wineventlog source="WinEventLog:System"
    (EventCode=5805 OR EventCode=5827 OR EventCode=5828
     OR EventCode=5829 OR EventCode=5830 OR EventCode=5831)
| bin _time span=5m
| stats count by _time, host, src_ip
| where count > 10
| sort - count

Microsoft Sentinel KQL — Netlogon service crash followed by lsass access

let netlogonCrash = Event
    | where EventLog == "System"
    | where Source == "Service Control Manager"
    | where EventID == 7034
    | where RenderedDescription contains "Netlogon"
    | project crashTime = TimeGenerated, Computer;
let lsassRead = DeviceProcessEvents
    | where ProcessCommandLine has_any ("lsass", "comsvcs.dll", "MiniDump")
    | project readTime = TimeGenerated, Computer, AccountName, ProcessCommandLine;
netlogonCrash
| join kind=inner lsassRead on Computer
| where readTime between (crashTime .. (crashTime + 10m))
| project crashTime, Computer, AccountName, ProcessCommandLine

Glossary

• Active Directory (AD) — Microsoft's directory service that holds user accounts, computer accounts, and group policies for a Windows network.
• Domain Controller (DC) — a server running AD Domain Services that authenticates users and computers in the domain.
• Netlogon — the Windows RPC service that runs all authentication conversations between a workstation and its DC. Runs as SYSTEM inside lsass.exe.
• MS-NRPC — Microsoft Netlogon Remote Protocol. The wire format Netlogon uses.
• RPC — Remote Procedure Call. A way for one Windows machine to invoke a function on another.
• NTDS.dit — the file on a DC that stores every domain user's password hash. The crown jewels.
• krbtgt — the special account whose password signs every Kerberos ticket. Theft = Golden Ticket attack = unlimited persistence.
• PDC Emulator — the FSMO role-holder DC that is the master time source and password-change authority for the domain.
• RODC — Read-Only Domain Controller. Used in branch sites. Still runs Netlogon, still vulnerable.
• CVSS — Common Vulnerability Scoring System. 9.0-10.0 = Critical.

Sources used in this lesson

1. NVD — CVE-2026-41089 official detail
2. Microsoft Learn — MS-NRPC Netlogon Remote Protocol spec
3. The Hacker News — May 2026 patches including Netlogon RCE
4. Tenable — May 2026 Patch Tuesday analysis
5. CrowdStrike — May 2026 Patch Tuesday telemetry
6. Rapid7 — Patch Tuesday May 2026 deep dive
7. The Hacker Recipes — ZeroLogon (CVE-2020-1472) historical context
8. CERT/CC VU#490028 — Netlogon AES-CFB8 cryptographic issue