The Centre for Cybersecurity Belgium (CCB) issued a warning on Friday that threat actors are actively exploiting a critical remote code execution (RCE) vulnerability in Windows Netlogon. The flaw, which was recently patched by Microsoft, affects the Netlogon protocol, a core component of Windows domain authentication.
As the country's national cybersecurity authority, the CCB flagged the exploitation as an active threat. The vulnerability is considered critical due to its potential to allow unauthenticated attackers to compromise domain controllers, the backbone of Windows network authentication. The severity underscores the urgency for organizations to apply available patches immediately.
Technical details indicate the attack vector targets the Netlogon Remote Protocol (NRP), which handles authentication for user and machine accounts. The flaw enables an attacker to bypass security checks and impersonate any machine on the network, potentially leading to full domain compromise.
Microsoft has released a security update to address the vulnerability. Organizations are strongly advised to install the patch without delay to block active exploitation. No mention of a workaround has been provided by the CCB or Microsoft beyond applying the official update.
Attribution for the ongoing attacks remains unclear. Broader threat landscape context is limited, though the warning suggests coordinated exploitation may be underway in Belgium or beyond.