CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Windows Server

product · product:windows-server

Coverage
1
first 2026-05-13 → last 2026-10-11
Latest activity
2026-06-02
A Netlogon overflow gives unauthenticated attackers SYSTEM on domain controllers; Belgium's CCB reports…
Peak priority
high
1 high
Targets
·
regions: europe
Sources cited
10
9 hosts

Action items (1)

Do-now tasks recorded on the entries about Windows Server, newest first. Check the date before acting on an older one.

  • Confirm every domain controller runs the May 2026 build or later (for example 10.0.17763.8755 on Server 2019, 10.0.20348.5074 on Server 2022, 10.0.26100.32772 on Server 2025) and patch any that does not.
    2026-05-13CVE-2026-41089 +3

Defender insights

What each entry about Windows Server tells a defender to do, newest first.

2026-05-13HIGHexploitedA Netlogon overflow gives unauthenticated attackers SYSTEM on domain controllers; Belgium's CCB reports exploitation that Microsoft has not confirmed

Exposure · detection

Story timeline

  1. 2026-05-13Microsoft May 2026 Patch Tuesday: Netlogon pre-auth RCE on domain controllers (CVE-2026-41089), later reported exploited by Belgium's CCB, leads four critical fixes
    trending-vulnerabilitiesA Netlogon overflow gives unauthenticated attackers SYSTEM on domain controllers; Belgium's CCB reports exploitation that Microsoft has not confirmed

Hunting pivots

CVEs (exploited first)
CVE-2026-41089CVE-2026-41096CVE-2026-41103CVE-2026-42898
Releases covered
Windows Server
Tags
actively-exploitedidentitypatch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Lateral MovementExploitation of Remote Services

Lateral Movement TA0008

T1210Exploitation of Remote Services×1

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

Evidence: 2026-05-13/cve-2026-41089-cve-2026-41096-cve-2026-41103-cve-2026-42898 · ATT&CK page ↗

Entries about Windows Server (1)

2026-05-13 · view entry permalink →

HIGHCVE-2026-41089 +3exploitedupdatedNATOA3

Microsoft May 2026 Patch Tuesday: Netlogon pre-auth RCE on domain controllers (CVE-2026-41089), later reported exploited by Belgium's CCB, leads four critical fixes

Microsoft's May 2026 Patch Tuesday fixed 118 vulnerabilities by Tenable's count, 16 rated critical, with none exploited or publicly disclosed at release (Tenable, 2026-05-12) (Krebs on Security, 2026-05-12); Help Net Security counts more than 120 (Help Net Security, 2026-05-12) and ZDI 138 (ZDI, 2026-05-12). The one that matters most is CVE-2026-41089 (CVSS 9.8), a stack-based buffer overflow in Windows Netlogon that lets an unauthenticated attacker execute code over the network (Microsoft MSRC); on a domain controller that means code execution as SYSTEM (CERT-EU, 2026-06-10). CVE-2026-41096 (CVSS 9.8) is a heap-based buffer overflow in the Windows DNS Client reachable through a malicious DNS response from an attacker able to influence replies (ZDI, 2026-05-12), which Microsoft assesses as less likely to be exploited (Krebs on Security, 2026-05-12). CVE-2026-41103 (CVSS 9.1) is an elevation of privilege in the Microsoft SSO Plugin for Jira and Confluence rated "Exploitation More Likely" (Tenable, 2026-05-12), and CVE-2026-42898 (CVSS 9.9) is a code-injection flaw in on-premises Dynamics 365 that requires an authenticated attacker (ZDI, 2026-05-12).

Contradiction: Belgium's CCB states that CVE-2026-41089 is exploited, on information from "trusted partners", while Microsoft told BleepingComputer it had no evidence to support the claim (CCB, 2026-05-29) (BleepingComputer, 2026-06-01).

CVE-2026-41089 (Windows Netlogon) is now actively exploited in the wild.

CCB 2026-05-29

Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

Microsoft MSRC
Updaterun 2026-06-02-8af85d01actionscvesevidenceimmediate_actionpriorityregionssectorssourcestagsbody

Belgium's Centre for Cybersecurity updated its May Patch Tuesday advisory on 2026-05-29 to say that CVE-2026-41089 is now actively exploited in the wild (CCB, 2026-05-29), and BleepingComputer and Help Net Security reported it on 2026-06-01 (BleepingComputer, 2026-06-01) (Help Net Security, 2026-06-01). CCB attributes the information to trusted partners, and Microsoft said it had no evidence to support the claim while recommending the security updates (BleepingComputer, 2026-06-01). CERT-EU relayed CCB's statement in its advisory of 2026-06-10 (CERT-EU, 2026-06-10).

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummaryimmediate_actionsectorstechniquesaffected_productscvessourcesevidenceclassificationactionsbodypriority

CCB's exploitation statement dates from 2026-05-29 and rests on information from trusted partners; Microsoft told BleepingComputer it had no evidence to support it (CCB, 2026-05-29) (BleepingComputer, 2026-06-01). Microsoft says 16 of the May CVEs, CVE-2026-41089 and CVE-2026-41096 among them, were found with its MDASH agentic system, and places the DNS Client flaw in dnsapi.dll (Microsoft Security Blog, 2026-05-12); no source says that flaw runs code as NetworkService. CVE-2026-41103 is an elevation of privilege, and CVE-2026-42898 requires an authenticated attacker (Tenable, 2026-05-12) (ZDI, 2026-05-12). The priority moves from critical to high: the exploitation claim rests on one national CERT's partner information, Microsoft said in a statement BleepingComputer added on 2026-06-02 that it had no evidence, and its advisory lists the flaw as not exploited (Microsoft MSRC); patching domain controllers remains the action.

vulnerability13 May 05:00Zmulti-sourceOpen finding →
Sources: Tenable · ZDI · Krebs on Security · Help Net Security · BleepingComputer · Microsoft MSRC · CCB · Microsoft Security Blog · CERT-EU

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • helpnetsecurity.com2 (20%)
  • bleepingcomputer.com1 (10%)
  • ccb.belgium.be1 (10%)
  • cert.europa.eu1 (10%)
  • krebsonsecurity.com1 (10%)
  • microsoft.com1 (10%)
  • msrc.microsoft.com1 (10%)
  • tenable.com1 (10%)
  • other1 (10%)
All cited sources (10)