Domain-Controller

vulnerabilities 2026-05-13
Windows Netlogon CVE-2026-41089: Unauthenticated RCE on Every Domain Controller
May Patch Tuesday's marquee bug is a stack-based buffer overflow in MS-NRPC that hands SYSTEM on any domain controller reachable over the network. Patch DCs first, before anything else.
CVE-2026-41089 windows netlogon active-directory domain-controller patch-tuesday rce

Windows Netlogon CVE-2026-41089: Unauthenticated RCE on Every Domain Controller