Windows Netlogon 0-Click RCE CVE-2026-41089 — Active Exploitation in the Wild (Domain Controller Takeover) — Threadlinqs Intelligence
As of 2026-06-01, Windows Netlogon 0-Click RCE CVE-2026-41089 — Active Exploitation in the Wild (Domain Controller Takeover) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.
Threat ID: TL-2026-0642 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
CVE-2026-41089 is a critical, pre-authentication (0-click) stack-based buffer overflow in the Windows Netlogon DC-locator service (MS-NRPC / CLDAP). A single crafted CLDAP request to UDP/389 of an
CVE-2026-41089 is a critical pre-authentication memory-corruption vulnerability in the Windows Netlogon component, specifically the DC-locator (LDAP ping) response path served by the Netlogon Remote Protocol (MS-NRPC) on Active Directory domain controllers. The flaw is exploitable by any unauthenticated attacker with network reachability to a DC, requires no user interaction (0-click), and Microsoft rates it as remote code execution with a CVSS 3.1 base score of 9.8. Because the affected code runs inside LSASS as SYSTEM, successful code execution yields complete control of the domain controller and, by extension, the entire Active Directory forest.
Root cause: the helper NetpLogonPutUnicodeString performs a character-by-character Unicode copy bounded only by a maximum character count, with no parameter for the destination buffer's total remaining size. A maximum string length value that is supplied in bytes is interpreted/treated as WCHARs, effectively doubling the number of characters written. BuildSamLogonResponse serializes a DC-locator response into a fixed 528-byte stack buffer inside NlGetLocalPingResponse, calling NetpLogonPutUnicodeString three times — for the server/host name (0x24 / 36 chars), the requesting username (0x82 / 130 chars, attacker-influenced), and the domain name (0x20 / 32 chars). When the attacker supplies a long username and the DC's own forest/domain/host FQDN labels are long (combined ~50+ characters), the server-controlled DNS-compressed name data is written past the buffer boundary, corrupting the GS stack cookie (located immediately past the buffer) and the saved return address (~0x48/72 bytes beyond the buffer end).
Trigger and exploit chain: the vulnerability is reached without any RPC opnum — an attacker sends a single connectionless LDAP (CLDAP) SearchRequest to UDP port 389. The malicious filter sets DnsDomain to the target domain, supplies a User attribute of 100+ characters (130 reliably triggers), and sets NtVer=0x02000000 (bits 2-3 clear) to force the legacy non-EX response path through the vulnerable BuildSamLogonResponse rather than the hardened BuildSamLogonResponseEx. The call chain is ntdsai!LDAP_CONN::SearchRequest -> netlogon!NlGetLocalPingResponse -> BuildSamLogonResponse -> NetpLogonPutUnicodeString. CLDAP DC-locator pings are processed before any credential check, making the attack fully pre-authentication.
Impact reality vs. escalation: public technical analysis (Aretiq, 0patch) confirms a single packet reliably produces a STATUS_STACK_BUFFER_OVERRUN (exception 0xc0000409) crash of LSASS, after which the domain controller automatically reboots in roughly 60 seconds. A 63-character DNS hostname label was shown to generate ~51 bytes of overflow — enough to corrupt the stack cookie and the return address region. Reliable, fully attacker-controlled RCE is constrained because the bytes that spill past the buffer are the server's own DNS name data rather than attacker-chosen payload bytes, and the overflow zone needed for a controlled return address is difficult to reach. Nevertheless, Microsoft, the CCB, and in-the-wild reporting treat CVE-2026-41089 as an RCE/domain-takeover threat: even absent code execution, an attacker who can repeatedly crash and reboot every domain controller in a forest causes a domain-wide authentication outage (mass DoS), and any reliable code-execution refinement on a DC running as SYSTEM enables the full post-exploitation kill chain below.
Post-exploitation (worst-case, SYSTEM on a DC): with code execution on a domain controller an adversary can perform OS credential dumping from the NTDS.dit database and LSASS, replicate directory secrets via DCSync (DRSUAPI GetNCChanges) to extract the krbtgt hash, forge Golden Tickets for persistent domain-wide authentication, create or elevate domain administrator accounts, manipulate group memberships, register a rogue/shadow domain controller (DCShadow), disable security tooling and logging, move laterally to
Weaknesses (CWE)
CWE-121, CWE-787, CWE-131, CWE-20
Target sectors: government, financial, healthcare, technology, education, energy, manufacturing, defense, telecommunications
Target regions: North America, Europe, Asia-Pacific, Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-41089, T1590, T1190, T1203, T1068, T1003, T1558, T1136, T1207, T1098, T1685
