CVE2026

CVE-2026-41089

1Rules

4References

1Folders

2026-06-02Latest

Summary

CVE-2026-41089 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2026. Coverage centers on windows / application.

Related Detections

Search this threat

Emerging Threathighexperimental

LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089

Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409). This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability, which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service, leading to a stack-based buffer overflow and subsequent crash of the LSASS process.

Windowsapplication

TA0040 · ImpactT1499 · Endpoint Denial of Servicecve.2026-41089detection.emerging-threats

Swachchhanda Shrawan Poudel (Nextron Systems)Tue Jun 022026

References