--- title: Critical Windows Netlogon RCE flaw now exploited in attacks description: Belgium's Centre for Cybersecurity (CCB) has warned that CVE-2026-41089, a critical stack-based buffer overflow in Windows Netlogon, is now being actively... canonical: https://daily.dev/posts/critical-windows-netlogon-rce-flaw-now-exploited-in-attacks-zyueyb492 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Critical Windows Netlogon RCE flaw now exploited in attacks | daily.dev og:description: Belgium's Centre for Cybersecurity (CCB) has warned that CVE-2026-41089, a critical stack-based buffer overflow in Windows Netlogon, is now being actively... og:url: https://daily.dev/posts/critical-windows-netlogon-rce-flaw-now-exploited-in-attacks-zyueyb492 og:image: https://api.daily.dev/og/posts/ZyueyB492.png og:image:alt: Critical Windows Netlogon RCE flaw now exploited in attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Critical Windows Netlogon RCE flaw now exploited in attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Belgium's Centre for Cybersecurity (CCB) has warned that CVE-2026-41089, a critical stack-based buffer overflow in Windows Netlogon, is now being actively exploited in the wild. The flaw allows unauthenticated attackers to achieve remote code execution on Windows domain controllers and affects all supported Windows Server versions including Server 2025. Microsoft patched it during May 2026 Patch Tuesday. Admins are urged to patch immediately. The article also notes a broader pattern of Windows zero-days disclosed by anonymous researcher 'Nightmare Eclipse,' several of which are also being exploited in attacks. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Critical Netlogon RCE Flaw Actively Exploited Against Windows Domain Controllers](https://daily.dev/posts/critical-netlogon-rce-flaw-actively-exploited-against-windows-domain-controllers-nrltrsik8) · Orca Security Blog · 0 upvotes · 0 comments - [Best of 2025: LDAPNightmare: SafeBreach Labs Publishes First Proof-of-Concept Exploit for CVE-2024-49112](https://daily.dev/posts/best-of-2025-ldapnightmare-safebreach-labs-publishes-first-proof-of-concept-exploit-for-cve-2024-4-migii1rlc) · Security Boulevard · 1 upvotes · 0 comments - [Critical RCE flaw in Windows IKE Extension now actively exploited](https://daily.dev/posts/critical-rce-flaw-in-windows-ike-extension-now-actively-exploited-jme1jp11r) · BleepingComputer · 1 upvotes · 0 comments - [Critical Microsoft bug from 2024 under exploitation](https://daily.dev/posts/critical-microsoft-bug-from-2024-under-exploitation-b3av1sodp) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft) [View this post on daily.dev](https://daily.dev/posts/critical-windows-netlogon-rce-flaw-now-exploited-in-attacks-zyueyb492) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Critical Windows Netlogon RCE flaw now exploited in attacks","url":"https://daily.dev/posts/critical-windows-netlogon-rce-flaw-now-exploited-in-attacks-zyueyb492","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/critical-windows-netlogon-rce-flaw-now-exploited-in-attacks-zyueyb492"},"datePublished":"2026-06-01T12:32:10.135Z","dateModified":"2026-06-01T12:32:36.845Z","description":"Belgium's Centre for Cybersecurity (CCB) has warned that CVE-2026-41089, a critical stack-based buffer overflow in Windows Netlogon, is now being actively...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/51bedf12208ce5d455984c7ec13b9967?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/51bedf12208ce5d455984c7ec13b9967?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/critical-windows-netlogon-rce-flaw-now-exploited-in-attacks-zyueyb492","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Critical Windows Netlogon RCE flaw now exploited in attacks"}]} ```