Belgium Flags a Netlogon RCE Microsoft Has Not Confirmed

Belgium’s cyber center says CVE-2026-41089, a CVSS 9.8 Windows Netlogon flaw, is under attack. Microsoft still marks it as not exploited.

The Centre for Cybersecurity Belgium updated its May Patch Tuesday warning on May 29, 2026, 17 days after Microsoft shipped the fix and rated attacks as less likely. CERT-EU later repeated the Belgian claim. The vendor page has not moved.

Microsoft Still Lists the Bug as Not Exploited

Microsoft released CVE-2026-41089 on May 12, 2026 as a critical remote code execution bug in Windows Netlogon. The company scores it 9.8 base and 8.5 temporal, CWE-121, stack-based buffer overflow. The Windows Attack Research & Protection team found it in house. There was no public write-up before Patch Tuesday.

The Exploitation Less Likely on the MSRC advisory is still the official line. Publicly disclosed: No. Exploited: No. That exploitability table is labeled as an assessment at original publication, and the scraped revisions list on the page shows no later flip.

MSRC SNAPSHOT AT PUBLICATION

• Impact: Remote code execution against a Windows server acting as a domain controller.
• Score: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with temporal E:U (exploit code unproven).
• Access: A crafted network request, no sign-in and no user action.
• Credit: Windows Attack Research & Protection (WARP) at Microsoft.

An unauthenticated write into LSASS on a domain controller is the kind of bug that usually jumps the queue. This one did not, because Microsoft filed it with the same “less likely” tag it uses for flaws it does not expect to see weaponized quickly.

118 Fixes and a Quiet Netlogon Critical

CCB counted 118 customer-actionable CVEs in the May 2026 Windows release, 16 critical and 102 important. It was the first such bundle since June 2024 with no zero-day that had already been exploited or posted in public before the patches shipped. Twelve bugs in that set were rated more likely to be exploited. Netlogon was not one of the twelve.

The Belgian note of May 13, 2026 treated the release as a normal, heavy Patch Tuesday. The updated May 29 exploitation warning is the line that changed the story: CVE-2026-41089 “is now actively exploited in the wild.” CCB told operators to patch as quickly as possible after testing.

https://x.com/CCBalert/status/2060392708259131674

CERT-EU advisory 2026-007, dated June 10, 2026, cited that Belgian update and told European institutions to patch domain controllers at once. CISA’s September 8, 2026 Known Exploited Vulnerabilities additions were four other bugs, including two Windows local-privilege flaws, not this Netlogon CVE. Patch queues that sort on Microsoft’s exploited flag, or on a fresh KEV row, still do not see a vendor confirmation.

FROM PATCH TUESDAY TO THE BELGIAN ALERT

1. May 12, 2026: Microsoft ships the Netlogon fix, scores it 9.8, and rates exploitation less likely.
2. May 13, 2026: CCB publishes its May Patch Tuesday warning covering 118 CVEs.
3. May 26, 2026: 0patch ships micropatches for Server 2008 R2, 2012, and 2012 R2 after reproducing the crash.
4. May 29, 2026: CCB updates the same advisory and says CVE-2026-41089 is exploited in the wild.
5. June 10, 2026: CERT-EU repeats the Belgian exploitation claim and lists patched builds.
6. September 9, 2026: TrustedSec CTO Justin Elze publishes a binary analysis that stops at a pre-auth crash, not proven RCE.

The May bundle’s own mix helps explain the delay. CCB’s type split was 29 remote code execution bugs, 57 elevation of privilege, 9 information disclosure, 7 spoofing, 8 denial of service, 6 security-feature bypass, and 2 tampering. A 9.8 Netlogon item sat inside that pile with a “less likely” tag, which is how a domain-controller bug misses the first maintenance window.

What CVE-2026-41089 Does to a Domain Controller

The attack is a malformed CLDAP request to UDP port 389, the connectionless LDAP path domain controllers use for DC locator pings. Mitja Kolsek at 0patch, writing on May 26, 2026, said a single crafted UDP packet overflows a stack buffer inside LSASS, corrupts memory, and crashes the process. The server reboots about 60 seconds later.

The bad copy lives in NetpLogonPutUnicodeString. Kolsek wrote that the maximum string length was interpreted as bytes but treated as WCHARs, which doubled the length the function would write. Microsoft’s fix hardens that function: a safer copy, a zeroed buffer, and a size argument that means bytes.

An attacker could send a specially crafted network request to a Windows server that is acting as a domain controller. If successful, this could cause the Netlogon service to improperly handle the request, potentially allowing the attacker to run code on the affected system without needing to sign in or have prior access.

Microsoft Security Response Center, CVE-2026-41089 advisory

WHAT THE PACKET NEEDS

• Reach: Network path to a domain controller’s CLDAP listener on UDP port 389.
• Identity: No domain account, no stolen hash, no user click.
• Process: The overflow runs in LSASS, so a crash kills sign-in for the domain until the DC comes back.
• Failure mode: 0patch’s reproduction ends in an LSASS crash and a reboot about 60 seconds later.

Aretiq AI reverse-engineered the May patch the next day and published a CLDAP stack overflow reverse-engineering note with a proof of concept. That write-up puts the stack buffer at 528 bytes in the DC-locator response handler inside netlogon.dll. Tanium later told customers to patch every domain controller in the same window, and named KB5089549 as the current-branch May cumulative that carries the fix.

Jason Kikta, CTO at Automox, put the forest problem in one line: half-patched forests are not a defensible state for a pre-auth domain-controller bug. One unpatched DC is enough if an attacker can reach UDP port 389 on it.

The DNS Length Gate on the Overflow

Aretiq’s CVSS 4.0 take is 8.8, not 9.8, because it sets Attack Requirements to Present. The combined locator response has to exceed that 528-byte buffer, which the write-up ties to a long DNS domain name, on the order of 50 or more characters, plus hostname data in the same packet.

That gate cuts the easy internet-wide spray. It does not save a company whose AD DNS name is already long, which is common in forests that nested a regional name under a corporate suffix. Short-name labs may fail to crash. Production domains with verbose DNS may overflow on the first packet.

The locator port is the other half of the exposure. CLDAP on UDP port 389 is how Windows finds a DC. Operators who locked down Netlogon RPC after Zerologon often left locator traffic open inside the site, and sometimes to partner networks, because discovery breaks when it is filtered too hard. This bug does not need the MS-NRPC channel those 2020 and 2021 updates sealed.

Which Windows Server Builds Need the May Patch

CERT-EU’s affected Windows Server version list covers every supported DC role from Server 2012 through Server 2025. The CVE record, updated August 10, 2026, gives the patched floors, including Server 2025 before 10.0.26100.32860. Member servers that are not domain controllers are outside the attack as Microsoft described it.

PATCHED BUILD FLOORS

Shops that never installed the May DCs still have the same domain controller patch lag after May, and the Belgian alert did not add a new binary. It only changed how people talk about a fix that has been sitting in WSUS since May 12, 2026.

Out-of-support boxes are a separate lane. Kolsek’s team shipped a single-instruction micropatch for Server 2008 R2, Server 2012, and Server 2012 R2. The patch is mov edx, 0x40, which halves the maximum size of the attacker-controlled username string. 0patch says that is the only value the attacker supplies into the bad copy.

0PATCH COVERAGE

• Server 2008 R2: Fully updated, with or without ESU 1 through ESU 4.
• Server 2012: Fully updated, with no ESU or with ESU 1.
• Server 2012 R2: Fully updated, with no ESU or with ESU 1.

Those micropatches were already pushed to online 0patch PRO and Enterprise agents on May 26, 2026, unless a group policy blocked them. They do not replace Microsoft’s May cumulative on supported DCs. They are for forests that still have a 2008 R2 or unpaid-ESU 2012 controller answering CLDAP.

Zerologon Left the Locator Port Open

Comparisons to Zerologon (CVE-2020-1472) showed up as soon as the CVE dropped, because both bugs let a network attacker abuse Netlogon on a domain controller with no account. Tom Tervoort at Secura found that 2020 bug in the cryptography of MS-NRPC. Microsoft patched it in August 2020 and spent the next six months forcing signing and sealing, with enforcement in February 2021.

CVE-2026-41089 is a memory bug on a different door. Zerologon hardening does not inspect a CLDAP username field on UDP port 389. A forest that finished the 2021 Netlogon enforcement project can still die on this packet.

TWO NETLOGON BUGS, TWO DOORS

CISA issued an emergency directive for Zerologon and later put it in the Known Exploited Vulnerabilities catalog with a ransomware-use flag. This 2026 overflow has a Belgian CSIRT saying “exploited,” a European CERT repeating that line, and a Microsoft page that still says No. That split is why some patch programs still have not treated the May DC update as an emergency.

Justin Elze’s Call on the RCE Claim

Public crash clips and GitHub proofs circulated in June. The reliable demo is the one 0patch filmed: packet in, LSASS dies, DC reboots. That is a domain outage. It is not, on its own, proof that attackers are running code as SYSTEM in the wild.

Justin Elze, CTO at TrustedSec, wrote on September 9, 2026 that he could not show a control-flow hijack that survives /GS in the shipped binaries. On 64-bit Windows Server 2019 (build 17763) he called the write a pre-auth out-of-bounds stack write that is bounded to the /GS cookie, then __report_gsfailure and a remote denial of service. He said the reach is 65 bytes short of any code pointer and the overwriting bytes are fixed.

the reliably reachable, verifiable outcome here is the pre-auth remote crash

Justin Elze, CTO, TrustedSec, on X, September 9, 2026

Elze added that an x86 build can reach a saved return address, but the remote DC-locator responder path is role-gated off and the /GS byte is neither leaked nor chosen by the attacker. In his account, RCE would need a second bug, such as an info leak plus an unbounded write, that this patch does not expose.

WHAT WE KNOW

• The vendor fix: May 12, 2026 updates close a stack overflow in Netlogon on domain controllers from Server 2012 through Server 2025.
• The public primitive: An unauthenticated CLDAP packet to UDP port 389 crashes LSASS and reboots the DC in about 60 seconds.
• The Belgian line: CCB, then CERT-EU, say the CVE is exploited in the wild and should be patched first.

WHAT IS UNCONFIRMED

• Microsoft’s exploited flag: The MSRC page still says Exploited: No and Exploitation Less Likely.
• Reliable RCE: Independent binary work in September 2026 has not shown a /GS-surviving code-execution path in the 64-bit DC locator.
• Named crews: No public, vendor-backed attribution names a ransomware affiliate or a state group using this CVE for SYSTEM on a DC.

A domain that cannot authenticate is already offline, so the crash is enough to justify the May updates on every DC, in one window, with UDP 389 limited to the hosts that must locate a controller. Microsoft’s own FAQ still describes code execution as the successful outcome. Until the exploited flag changes, the Belgian warning and the crash PoC are the two facts operators can actually hold.