Windows Active Directory Domain Services Denial of Service Vulnerability

MonitorCVSS 6.5CVE-2026-50366Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A null pointer dereference vulnerability in Windows Active Directory Domain Services allows an authorized attacker to cause a denial of service by sending a crafted network request to a domain controller. This crashes the AD service, preventing users and systems from authenticating or accessing domain resources. The vulnerability affects Windows Server 2016, 2019, 2022, 2025 and Windows 10/11 systems.

What this means
What could happen
An authenticated attacker on your network could crash or temporarily disable your Active Directory domain services, making it impossible for users to log in or access network resources until the service recovers.
Who's at risk
Water utilities and electric utilities using Windows domain controllers (any Windows Server 2016 through 2025 or Windows 10/11) are affected. This impacts any facility relying on Active Directory for network authentication, access control, and identity management for SCADA workstations, engineering systems, and IT networks.
How it could be exploited
An attacker with valid AD credentials could send a specially crafted network request to a domain controller, triggering a null pointer dereference in the AD Domain Services process. This causes the service to crash, disrupting authentication and network resource access until the service is manually restarted.
Prerequisites
  • Valid user credentials (any AD user account)
  • Network access to domain controller on LDAP ports (389 TCP/UDP or 636 TCP for LDAPS)
  • Domain controller running affected Windows Server or Windows 10 version
remotely exploitablerequires authenticationlow complexityno authentication required for some scenariosaffects domain infrastructure
Exploitability
Some exploitation risk — EPSS score 1.1%
Affected products (23)
23 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9020
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9020
Windows Server 2019All versionsBuild 10.0.17763.9020
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9020
Windows Server 2022All versionsBuild 10.0.20348.5386
Remediation & Mitigation
0/4
Do now
0/2
HARDENINGMonitor Active Directory Domain Services process logs for unexpected crashes or service restarts
WORKAROUNDRestrict LDAP and LDAPS access (ports 389, 636) to domain controllers to only trusted workstations and systems that require AD queries
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXApply the 2026-Jul security update to all domain controllers and domain-joined Windows systems
HOTFIXPrioritize patching domain controllers first to restore full AD service availability
API: /api/v1/advisories/9fa2549d-0b7f-4be3-adcd-689b2fb1b85c

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows Active Directory Domain Services Denial of Service Vulnerability | CVSS 6.5 - OTPulse