Threat Actors Exploit Critical Windows Netlogon Vulnerability in Belgium

BRUSSELS — Threat actors are actively exploiting a critical remote code execution vulnerability in Windows Netlogon, targeting domain controllers across Belgium. The attack, identified as CVE-2026-41089, was detected on June 1, 2026, at 12:35 UTC, marking a significant escalation in cyber operations against critical infrastructure.

The vulnerability allows attackers to execute arbitrary code on affected systems without authentication. Security researchers have confirmed that the flaw impacts Windows domain controllers, which manage user authentication and network security policies. Successful exploitation grants attackers full control over the compromised network, enabling data exfiltration, lateral movement, and potential disruption of essential services.

Belgian cybersecurity authorities have issued an urgent advisory to organizations operating Windows-based environments. The advisory urges immediate patching of affected systems and implementation of compensating controls where updates cannot be applied immediately. Network administrators are advised to monitor for unusual activity, particularly unauthorized access attempts and unexpected changes to domain policies.

The attack vector leverages the Netlogon Remote Protocol, a component used for secure communication between domain controllers and client systems. By sending specially crafted requests, threat actors can bypass security mechanisms and execute malicious payloads. The vulnerability is considered critical due to its ease of exploitation and the high level of access it provides to attackers.

No specific threat group has been attributed to the campaign. However, the sophistication of the attacks suggests involvement of state-sponsored actors or organized cybercrime syndicates. The timing of the exploitation, occurring shortly after the vulnerability's disclosure, indicates that threat actors were likely aware of the flaw before it was publicly announced.

Microsoft has released a security update to address the vulnerability. The company recommends applying the patch immediately to mitigate the risk of exploitation. Organizations that cannot patch immediately should consider isolating affected systems from the network and implementing additional monitoring measures.

The impact of the attacks remains unclear as organizations assess the extent of the compromise. Some entities have reported successful intrusions, while others have detected and blocked attempts. The situation is developing, with cybersecurity firms continuing to monitor for new indicators of compromise and emerging attack patterns.

Questions remain regarding the full scope of the campaign and the identity of the threat actors involved. Authorities are investigating whether the attacks are part of a broader coordinated effort targeting critical infrastructure across Europe. The incident underscores the urgent need for organizations to maintain robust cybersecurity practices and respond swiftly to emerging threats.