Windows Server vulnerability can grant system privileges with just a malformed packet — domain controllers are being exploited in the wild

A critical vulnerability in Windows Server domain controllers (DC) has been identified, allowing unauthenticated users to potentially gain system privileges by sending a malformed UDP packet. The exploit, rated 9.8, affects versions 2012 to current and can lead to denial-of-service scenarios or unauthorized access. The vulnerability, CVE-2026-41089, impacts the Netlogon service and requires immediate patching to mitigate risks. Microsoft has confirmed exploitation in the wild and advises administrators to treat it as a serious threat, patching all linked DCs promptly to prevent network insecurity.