OTPulse

Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability

Plan PatchCVSS 8.8CVE-2026-62795Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

A use-after-free vulnerability in Windows LDAP (Lightweight Directory Access Protocol) allows an unauthenticated attacker on the network to execute arbitrary code by sending a specially crafted LDAP request. The vulnerability affects Windows 10 (all versions from 1607 to 22H2), Windows 11 (all versions from 23H2 to 26H1), Windows Server 2016, 2019, 2022, and 2025. Microsoft has released security updates for all affected versions.

What this means
What could happen
An attacker could execute arbitrary code on a Windows computer or server by sending a specially crafted network request to the LDAP service, potentially gaining control of the system and any critical infrastructure it manages.
Who's at risk
Windows IT administrators managing Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems that run LDAP services (especially domain controllers in Active Directory environments). Any organization using these systems for authentication, file sharing, or print services should be concerned.
How it could be exploited
An attacker on the network sends a malformed LDAP request that triggers a use-after-free memory vulnerability in the Windows LDAP service. This allows the attacker to execute arbitrary code with the privileges of the LDAP service, typically SYSTEM on domain controllers or high-privilege accounts on member servers.
Prerequisites
  • Network access to LDAP port (typically port 389 or 636)
  • LDAP service must be running and reachable
  • No authentication required to trigger the vulnerability
Remotely exploitableNo authentication requiredLow complexity attackAffects domain controllers and critical serversHigh CVSS score (8.8)
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9115
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9115
Windows Server 2019All versionsBuild 10.0.17763.9115
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9115
Windows Server 2022All versionsBuild 10.0.20348.5499
Remediation & Mitigation
0/3
Do now
0/1
WORKAROUNDRestrict LDAP port access (389/636) to only authorized administrative networks and clients using firewall rules
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the August 2026 Windows security update to all affected systems
Long-term hardening
0/1
HARDENINGDisable LDAP on systems that do not require it
View full vendor advisory
API: /api/v1/advisories/60d735f0-5a13-43b7-8650-2fe3145ece0d

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability | CVSS 8.8 - OTPulse