Windows Netlogon Remote Code Execution Vulnerability

A critical Windows Netlogon vulnerability (CVE-2026-41089) enabling unauthenticated remote code execution against domain controllers is being actively exploited in the wild; Microsoft issued a May 2026 patch and defenders are advised to prioritize patching, restrict RPC access, review logs, validate backups, and perform threat hunting. FortiGuard lists IPS, endpoint vulnerability management, antivirus/behavior detection, incident response, web filtering, and ongoing threat intelligence to help detect and mitigate exploitation and post-compromise activity.