CVE-2026-41089: Windows Netlogon Patch, IOCs, Detection, and Mitigation Guide

The Patch: What Microsoft Actually Fixed

The May 2026 Patch Tuesday update introduces a bounded replacement for the vulnerable string-writing function inside netlogon.dll. The fix is gated behind a feature flag, meaning it can be audited precisely in patched vs. unpatched binary comparisons.

Technical Nature of the Fix

In plain terms: the old function wrote characters into a fixed buffer until it was done, with no awareness of how large the buffer was. The new function is told the buffer size upfront and stops writing when it reaches the limit, returning an error instead of overflowing into adjacent stack memory.

Patch Coverage by Windows Server Version

Verify Patch Status on a Domain Controller

# Method 1 - Check KB installation
wmic qfe get HotFixID | findstr KB5089549

# Method 2 - Check OS build number (Settings > About, or PowerShell)
[System.Environment]::OSVersion.Version

# Method 3 - Verify netlogon.dll hash directly
Get-FileHash C:\Windows\System32\netlogon.dll -Algorithm SHA256

# Expected patched hash:
A59733767285859FC3F982C46EA9C1173F4BF025D1569C03B4D137B55132B2DB

# Method 4 - Check file version
(Get-Item C:\Windows\System32\netlogon.dll).VersionInfo.FileVersion

Workarounds for Systems That Cannot Immediately Patch

These controls reduce exploitability while patches are being tested and deployed. They are not substitutes for patching - they are temporary risk reducers for environments with patch testing cycles or legacy systems.

# Enable Netlogon debug logging on all domain controllers
nltest /dbflag:0x2080ffff

# Log output path
%windir%\debug\netlogon.log
%windir%\debug\netlogon.bak

# Disable after patching to avoid log volume overhead
nltest /dbflag:0x0

Indicators of Compromise (IOCs)

No infrastructure IOCs (attacker IPs, C2 domains, campaign-specific file hashes) have been publicly released by CCB or any threat intelligence source as of June 2, 2026. The available IOCs are behavioral and signature-based, focused on the crash condition and the network-level exploit trigger.

Network-Level IOCs

Host-Level IOCs

Persistence Mechanism IOCs (Post-RCE)

If an attacker achieves full RCE rather than DoS, the following persistence mechanisms are relevant based on the vulnerability class and historical Netlogon-targeting attack patterns:

Detection: SIEM Queries

Splunk

# Detect LSASS crash with netlogon.DLL faulting module
index=wineventlog source="WinEventLog:Application"
  EventID=1000
  Process_Name="lsass.exe"
  Module_Name="netlogon.DLL"
  Exception_Code="0xc0000409"
| eval risk="CRITICAL - Possible CVE-2026-41089 exploitation"
| table _time, host, Process_Name, Module_Name, Exception_Code, risk

# Detect child processes spawned by lsass.exe (post-RCE signal)
index=sysmon EventCode=1 ParentImage="*lsass.exe"
| eval risk="CRITICAL - Abnormal LSASS child process"
| table _time, host, Image, ParentImage, CommandLine, risk

Elastic / Lucene (KQL)

# LSASS crash detection
event.code:1000 AND
process.name:lsass.exe AND
winlog.event_data.ModuleName:*netlogon* AND
winlog.event_data.ExceptionCode:0xc0000409

# LSASS outbound network connection (Sysmon EID 3)
event.code:3 AND process.name:lsass.exe AND
NOT destination.ip:(127.0.0.1 OR "::1")

Microsoft Sentinel (KQL)

# LSASS crash with netlogon faulting module
SecurityEvent
| where EventID == 1000
| where CommandLine contains "lsass.exe"
    and CommandLine contains "netlogon.DLL"
    and CommandLine contains "0xc0000409"
| project TimeGenerated, Computer, CommandLine
| extend Risk = "CRITICAL - CVE-2026-41089 candidate"

# Privileged group membership changes outside business hours
SecurityEvent
| where EventID in (4728, 4732, 4756)
| where MemberName !contains "expected-admin"
| where hourofday(TimeGenerated) !between (8 .. 18)
| project TimeGenerated, Computer, SubjectUserName, MemberName, GroupName

Immediate Response Actions

Long-Term Hardening Recommendations

Part 4 covers MITRE ATT&CK mapping, advanced SIEM queries, and domain controller hardening for CVE-2026-41089.