CVE-2026-41089 Detection Tool

This is a CVE-2026-41089 detection script for defense audits. The vulnerability is a Windows Netlogon remote code execution vulnerability disclosed by Microsoft in the May 2026 security update.

The script does not send exploit packets or attempt to trigger Netlogon exceptions. It prioritizes reading the file version of the affected component netlogon.dll, then checks installed KBs, and finally uses the system complete build number as a fallback, reducing false positives from relying solely on OS version numbers.

Usage

Detect the local Windows host:

python .\cve_2026_41089_check.py

Detect a remote Windows host via CIM/WMI:

python .\cve_2026_41089_check.py --target dc01.example.com --format json

Detect using offline asset information:

python .\cve_2026_41089_check.py --input-json .\sample_facts.json --format csv

View MSRC current fix information:

python .\cve_2026_41089_check.py --update-msrc

Exit codes:

• 0: No vulnerable hosts found
• 1: Execution or query failed
• 2: At least one potentially affected host found

Detection Logic

Evidence priority:

1. netlogon.dll file version: directly checks the version of the vulnerability-related component, highest priority.
2. Installed KBs: matches the fix updates published by Microsoft.
3. OS complete build number: only used as a fallback when component version is unavailable.
4. Domain controller role: the vulnerability exploitation scenario targets Windows Server as a domain controller.

Result status:

• patched: component version reaches the fix version, or matching KB is installed.
• vulnerable: on domain controllers, netlogon.dll component version is lower than the fix version, or component version unavailable but system build and KB evidence still show below the fix level.
• not_affected: not within affected product/component scope, or host is not a domain controller.
• unknown: insufficient information to determine.

The evidence field in the output explains the basis of judgment, for example:

• netlogon.dll_version
• installed_kb
• os_build_fallback
• domain_role

Fix Versions

Data source: Microsoft MSRC 2026-May CVRF.

Offline Asset Sample

{
  "target": "dc01",
  "caption": "Microsoft Windows Server 2019 Standard",
  "version": "10.0.17763",
  "build_number": "17763",
  "ubr": "8000",
  "product_type": 2,
  "domain_role": 5,
  "netlogon_file_version": "10.0.17763.8000",
  "installed_kbs": []
}

About Active Vulnerability Verification

This project does not provide exploit-based probing, crash verification, or request construction that can be used to reproduce RCE. For production domain controllers, such verification carries high risk and is not suitable for public repositories.

If you need to further reduce false positives, it is recommended to combine the following defensive evidence:

• Read the file version of C:\Windows\System32\netlogon.dll
• Check KB installation records in patch management systems
• Confirm whether the host is a domain controller
• Check maintenance windows and reboot status

References

• Microsoft MSRC: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089
• CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-41089
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41089

Disclaimer

This project is intended only for defense audits in authorized environments. Before taking production action, please cross-check results with Microsoft official announcements, patch management systems, and change records.