cve-2026-41089

CVE-2026-41089 is a Microsoft-disclosed Windows Netlogon remote code execution vulnerability published in the Security Update Guide on May 12, 2026. It affects the authentication plumbing Windows domains use to establish trusted communication between domain-joined machines and domain controllers. The combination of Netlogon and remote code execution makes this vulnerability critical for administrators. Microsoft's May 2026 security update path is the supported remediation. Patching should prioritize domain controllers reachable from untrusted networks, such as internet-facing paths, partner routes, broad VPN pools, lab networks, DMZ routes, contractor networks, unmanaged client networks, or legacy firewall exceptions. Next, patch branch-office and low-redundancy domain controllers, then complete remaining domain controllers in the forest during the same approved remediation campaign.