Windows Netlogon 0-Click RCE Vulnerability Under Active Exploitation

Microsoft’s May 2026 Patch Tuesday release has taken a critical turn after security researchers confirmed that a high-risk Windows Netlogon vulnerability is now being actively exploited in the wild.

Tracked as CVE-2026-41089, the vulnerability allows unauthenticated attackers to execute remote code against domain controllers without any user interaction, making it one of the most dangerous vulnerabilities in recent months.

The vulnerability affects the Windows Netlogon service, a core component responsible for authentication and secure communication within Windows domain environments.

What makes this vulnerability particularly severe is its zero-click nature. Attackers do not need credentials or user interaction to trigger exploitation.

This significantly lowers the barrier for threat actors and increases the likelihood of widespread attacks, especially in enterprise environments where domain controllers are critical infrastructure.

According to Microsoft, an attacker can exploit the vulnerability by sending a specially crafted network request to a domain controller. If successful, the Netlogon service improperly processes the request, allowing execution of malicious code with SYSTEM-level privileges.

Security authorities have warned that successful exploitation could lead to complete domain compromise, enabling attackers to move laterally, deploy ransomware, or exfiltrate sensitive data. The issue affects Windows Server versions starting from 2012, and patches are already available.

Windows Netlogon 0-Click Vulnerability

In total, Microsoft addressed 118 vulnerabilities in its May 2026 Patch Tuesday release, including 16 rated as critical and 102 as important.

The vulnerabilities span multiple categories, including remote code execution, privilege escalation, spoofing, denial of service, and security feature bypass.

Among these, 29 vulnerabilities are classified as remote code execution, while 57 involve elevation of privilege risks.

Notably, Microsoft reported that none of the vulnerabilities were publicly disclosed or exploited prior to release, marking the first such occurrence since June 2024. However, twelve vulnerabilities were flagged as more likely to be exploited, highlighting the urgency of applying updates.

Another critical issue, CVE-2026-41096, affects the Windows DNS Client and could allow attackers to execute code by sending a malicious DNS response.

This vulnerability can lead to memory corruption and potential remote compromise without authentication in certain configurations.

Additionally, CVE-2026-41103 impacts the Microsoft SSO plugin for Jira and Confluence. This elevation of privilege vulnerability allows attackers to forge authentication responses, potentially granting unauthorized access to enterprise collaboration platforms and enabling actions under compromised user accounts.

Microsoft also republished 127 Chrome-related CVEs and one AMD-related vulnerability, along with fixes for Microsoft Edge and cloud services, which are typically patched automatically.

The situation escalated on May 29, 2026, when CVE-2026-41089 was confirmed to be under active exploitation. Security agencies, including the Center for Cybersecurity Belgium, have issued urgent advisories recommending immediate patching after appropriate testing.

Organizations are also advised to enhance monitoring and detection capabilities to identify suspicious activity related to Netlogon abuse or unusual authentication patterns. Since patching does not address past compromise, incident response readiness is equally important.

The emergence of an actively exploited zero-click vulnerability in a core Windows service underscores the growing sophistication of threat actors.

With domain controllers as prime targets, organizations must prioritize patch deployment and continuous monitoring to reduce the risk of large-scale breaches.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.