#netlogon

Analysis · Jun 2, 2026 · Colten Anderson

One CERT says it's exploited, Microsoft says it isn't, and you patch anyway

A pre-auth SYSTEM RCE on every domain controller doesn't need an exploitation rumor to earn the top of your patch queue. The interesting part is why the alarm and the data disagree, and why that disagreement shouldn't change your call.