Belgium's Cyber Agency Says Critical Windows Netlogon Flaw CVE-2026-41089 Is Now Being Exploited — Microsoft Disputes It

Overview

Belgium’s national cybersecurity authority has warned that a critical remote code execution vulnerability in Windows Netlogon is being actively exploited in the wild, while Microsoft says it has seen no evidence to support that claim. The vulnerability, tracked as CVE-2026-41089, is a stack-based buffer overflow in Windows Netlogon that carries a maximum-tier severity rating and, if exploited, could give an attacker control over a Windows domain.

According to the National Vulnerability Database, the flaw is a “Stack-based buffer overflow in Windows Netlogon” that “allows an unauthorized attacker to execute code over a network.” NVD assigns it a base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and classifies it as CWE-121: Stack-based Buffer Overflow.

What We Know

Microsoft published the CVE-2026-41089 advisory on May 12, 2026, per the NVD record. SecurityWeek reported that the fix shipped as part of the May 2026 Patch Tuesday release alongside 136 other bugs, and described the issue as a “stack-based buffer overflow issue that could be exploited via crafted network requests.” Because Netlogon is the protocol that handles authentication within a Windows domain, SecurityWeek notes the affected systems are Windows servers acting as domain controllers.

BleepingComputer reported that the flaw affects all currently supported Windows Server versions, including Windows Server 2025, and that it can be exploited for remote code execution without privileges or prior access. The same outlet reported that the bug was discovered internally by Microsoft’s Windows Attack Research & Protection (WARP) team.

The new development is the exploitation warning. The Centre for Cybersecurity Belgium (CCB) said the vulnerability is now actively exploited in the wild, according to Help Net Security. BleepingComputer reported that the CCB said it received the information from trusted partners but provided no additional details.

Microsoft pushed back on the warning. SecurityWeek reported that Microsoft disputed the CCB’s claims, said it found no evidence to support them, and recommended that customers “follow CVE-2026-41089 guidance and install the latest security updates.” The same outlet reported that, at the time of publication, there were no other reports of the vulnerability being exploited in attacks.

Why It Matters

Netlogon vulnerabilities are dangerous precisely because of where they sit. A successful attack on a domain controller can cascade into full control of an Active Directory environment, making this class of flaw a high-value target for ransomware operators and espionage actors alike.

For defenders, the practical advice is straightforward. Jason Kikta, CTO at Automox, told Help Net Security that organizations should “Patch the flaw on all domain controllers in the same maintenance window,” and also recommended restricting Netlogon traffic at the network layer and reviewing domain controller exposure. Help Net Security listed potential indicators of exploitation, including “The Netlogon service unexpectedly crashing or restarting,” anomalous Netlogon traffic from non-domain-controller source addresses, and authentication failures or domain trust errors.

The flaw had not initially been flagged as a likely target. SecurityWeek reported that Microsoft had not designated CVE-2026-41089 as likely to be exploited, even though roughly a dozen other May 2026 vulnerabilities received that designation, and Help Net Security noted that Microsoft initially deemed exploitation “less likely.” The vulnerability previously surfaced only in passing in Machine Herald’s coverage of Microsoft’s May Patch Tuesday, where it was listed among the most severe bugs of the month, as previously reported.

What We Don’t Know

The CCB has not published technical details of the attacks it cited, including who is being targeted, by whom, or at what scale, according to BleepingComputer, which reported only that the agency attributed its information to trusted partners. With Microsoft and the CCB offering conflicting assessments, and no corroborating reports of in-the-wild attacks at the time of the warnings, the precise exploitation status remains unsettled. What is not in dispute is the severity of the underlying flaw or the recommended fix: organizations running affected Windows Server domain controllers are advised to apply the May 2026 update.