<?xml version='1.0' encoding='UTF-8'?>
<?xml-stylesheet href="/static/style.xsl" type="text/xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
  <id>https://vulnerability.circl.lu/sightings/feed</id>
  <title>Most recent sightings.</title>
  <updated>2026-06-04T22:53:34.815017+00:00</updated>
  <author>
    <name>Vulnerability-Lookup</name>
    <email>info@circl.lu</email>
  </author>
  <link href="https://vulnerability.circl.lu" rel="alternate"/>
  <generator uri="https://lkiesow.github.io/python-feedgen" version="1.0.0">python-feedgen</generator>
  <subtitle>Contains only the most 10 recent sightings.</subtitle>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/a6859885-201a-46ef-952e-d6fa98e4c7b5/export</id>
    <title>a6859885-201a-46ef-952e-d6fa98e4c7b5</title>
    <updated>2026-06-04T22:53:34.821633+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cve.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "a6859885-201a-46ef-952e-d6fa98e4c7b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41089", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/116692084819803958", "content": "@christopherkunz I also tested another PoC and it was even more fake.  i.e. it didn't even create a CLDAP structure that made sense.\nI get that PoC||GTFO is a thing, but we've clearly entered a phase where it needs to be Verified PoC||GTFO.  \ud83e\udd26\u200d\u2642\ufe0f", "creation_timestamp": "2026-06-04T13:31:49.166065Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/a6859885-201a-46ef-952e-d6fa98e4c7b5/export"/>
    <published>2026-06-04T13:31:49.166065+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/45455e32-2689-42ec-b790-34c0f0293719/export</id>
    <title>45455e32-2689-42ec-b790-34c0f0293719</title>
    <updated>2026-06-04T22:53:34.821523+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cve.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "45455e32-2689-42ec-b790-34c0f0293719", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-41089", "type": "seen", "source": "https://bsky.app/profile/hakksaww.bsky.social/post/3mnht7h2hhq2r", "content": "And the second 9.8: Windows Netlogon CVE-2026-41089 \u2014 one packet \u2192 DC RCE on every Windows Server since 2012, exploited now. Detect non-DC Netlogon RPC sessions: https://www.dugganusa.com/post/windows-netlogon-cve-2026-41089-one-packet-to-your-domain-controller-every-windows-server-since-20", "creation_timestamp": "2026-06-04T14:23:48.462069Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/45455e32-2689-42ec-b790-34c0f0293719/export"/>
    <published>2026-06-04T14:23:48.462069+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/bacc2d6c-c163-47cb-9a18-f64e5ee84e97/export</id>
    <title>bacc2d6c-c163-47cb-9a18-f64e5ee84e97</title>
    <updated>2026-06-04T22:53:34.821416+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cve.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "bacc2d6c-c163-47cb-9a18-f64e5ee84e97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-41089", "type": "seen", "source": "https://chaos.social/users/christopherkunz/statuses/116692326268359320", "content": "@wdormann Of all the writeups, I think I like this one best, especially with it having a human name in the byline: https://adscanpro.com/blog/patch-diffing-cve-2026-41089-netlogon\"read advisories carefully before deciding how to allocate research time.\" made me chuckle.", "creation_timestamp": "2026-06-04T14:33:13.189200Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/bacc2d6c-c163-47cb-9a18-f64e5ee84e97/export"/>
    <published>2026-06-04T14:33:13.189200+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/c3a2f2f3-f12d-4675-9841-c8aea9939984/export</id>
    <title>c3a2f2f3-f12d-4675-9841-c8aea9939984</title>
    <updated>2026-06-04T22:53:34.821308+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cve.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "c3a2f2f3-f12d-4675-9841-c8aea9939984", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41089", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/116692370054132541", "content": "@christopherkunz @wdormann Here's a new one to take a look at. I haven't gone through it and can't vouch for its legitimacy, but y'all know what you're doing more than I do anyway: https://github.com/Vanquishermacdetach/CVE-2026-41089-509", "creation_timestamp": "2026-06-04T14:44:22.436745Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/c3a2f2f3-f12d-4675-9841-c8aea9939984/export"/>
    <published>2026-06-04T14:44:22.436745+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/85ca1efe-231d-40c4-ac7e-ea54a077c19b/export</id>
    <title>85ca1efe-231d-40c4-ac7e-ea54a077c19b</title>
    <updated>2026-06-04T22:53:34.821198+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cve.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "85ca1efe-231d-40c4-ac7e-ea54a077c19b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41089", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/87293", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-41089-509\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Vanquishermacdetach\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 5  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-04 14:42:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-41089 PoC \u2014 Netlogon CLDAP stack buffer overflow (CVSS 9.8 CRITICAL)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-06-04T15:00:04.000000Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/85ca1efe-231d-40c4-ac7e-ea54a077c19b/export"/>
    <published>2026-06-04T15:00:04+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/31b25828-9204-4760-8951-ee958bdfb301/export</id>
    <title>31b25828-9204-4760-8951-ee958bdfb301</title>
    <updated>2026-06-04T22:53:34.821080+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cve.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "31b25828-9204-4760-8951-ee958bdfb301", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41089", "type": "seen", "source": "https://t.me/GithubRedTeam/87310", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-41089-532\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Darkuoremember32\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 76  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-04 16:56:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-41089 PoC \u2014 Netlogon CLDAP stack buffer overflow (CVSS 9.8 CRITICAL)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-06-04T17:00:04.000000Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/31b25828-9204-4760-8951-ee958bdfb301/export"/>
    <published>2026-06-04T17:00:04+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/0c5dc0cb-2340-4116-972a-42eead07cc5b/export</id>
    <title>0c5dc0cb-2340-4116-972a-42eead07cc5b</title>
    <updated>2026-06-04T22:53:34.820967+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cve.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "0c5dc0cb-2340-4116-972a-42eead07cc5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41089", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/87318", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-41089-470\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Darkuoremember32\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 71  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-04 17:52:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-41089 PoC \u2014 Netlogon CLDAP stack buffer overflow (CVSS 9.8 CRITICAL)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-06-04T18:00:04.000000Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/0c5dc0cb-2340-4116-972a-42eead07cc5b/export"/>
    <published>2026-06-04T18:00:04+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/53e1070c-cf33-4001-9298-05bced0c2bcb/export</id>
    <title>53e1070c-cf33-4001-9298-05bced0c2bcb</title>
    <updated>2026-06-04T22:53:34.820843+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cve.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "53e1070c-cf33-4001-9298-05bced0c2bcb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41089", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/87322", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-41089-646\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a CrowEvaluate\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 56  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-04 18:59:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-41089 PoC \u2014 Netlogon CLDAP stack buffer overflow (CVSS 9.8 CRITICAL)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-06-04T19:00:04.000000Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/53e1070c-cf33-4001-9298-05bced0c2bcb/export"/>
    <published>2026-06-04T19:00:04+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/76e9a12b-bb7a-43f5-97bf-1b71dca61d77/export</id>
    <title>76e9a12b-bb7a-43f5-97bf-1b71dca61d77</title>
    <updated>2026-06-04T22:53:34.820694+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cve.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "76e9a12b-bb7a-43f5-97bf-1b71dca61d77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41089", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/87323", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-41089-874\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Retrodraseparator\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 56  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-04 18:56:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-41089 PoC \u2014 Netlogon CLDAP stack buffer overflow (CVSS 9.8 CRITICAL)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-06-04T19:00:06.000000Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/76e9a12b-bb7a-43f5-97bf-1b71dca61d77/export"/>
    <published>2026-06-04T19:00:06+00:00</published>
  </entry>
  <entry>
    <id>https://vulnerability.circl.lu/sighting/ba065627-e75e-4713-9869-4ec6282877c3/export</id>
    <title>ba065627-e75e-4713-9869-4ec6282877c3</title>
    <updated>2026-06-04T22:53:34.819075+00:00</updated>
    <author>
      <name>Automation user</name>
      <uri>https://cve.circl.lu/user/automation</uri>
    </author>
    <content>{"uuid": "ba065627-e75e-4713-9869-4ec6282877c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41089", "type": "seen", "source": "https://t.me/GithubRedTeam/87329", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-41089-806\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a VergeWarlord\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-04 20:02:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-41089 PoC \u2014 Netlogon CLDAP stack buffer overflow (CVSS 9.8 CRITICAL)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-06-04T20:02:55.000000Z"}</content>
    <link href="https://vulnerability.circl.lu/sighting/ba065627-e75e-4713-9869-4ec6282877c3/export"/>
    <published>2026-06-04T20:02:55+00:00</published>
  </entry>
</feed>
