Windows Server vulnerability can grant system privileges with just a malformed packet — domain controllers are being exploited in the wild

Microsoft disclosed CVE-2026-41089, a critical Netlogon flaw in Windows Server domain controllers from 2012 onward.

A same-network attacker can send a crafted UDP packet to trigger a buffer overflow, potentially gaining SYSTEM-level access or forcing a reboot.

The issue is reportedly being exploited in the wild, making patching urgent rather than relying on mitigation.

Because it affects domain controllers, successful exploitation could put an entire Windows domain at risk.