Active Directory Domain Services Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-69359Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A heap-based buffer overflow vulnerability in Active Directory Domain Services allows an authorized local user to escalate privileges on a Windows system that is joined to an Active Directory domain. The vulnerability affects Windows 10 (multiple versions), Windows 11 (multiple versions), Windows Server 2016, 2019, 2022, and 2025. Microsoft has released security updates for all affected versions.
What this means
What could happen
An attacker with local user access to a Windows system joined to an Active Directory domain could overflow a buffer in the domain authentication system to gain administrative privileges on that machine, potentially allowing them to modify network configurations, access sensitive files, or alter critical processes.
Who's at risk
Organizations running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 systems that are members of an Active Directory domain. This affects IT infrastructure workstations, domain controllers, member servers, and OT systems integrated into domain environments (SCADA servers, HMI workstations, engineering stations, historian servers).
How it could be exploited
An attacker with a valid local user account on a Windows system could craft a malicious request to Active Directory Domain Services running locally. The heap-based buffer overflow would execute arbitrary code with system-level privileges, escalating from user to administrator role.
Prerequisites
- Local user account on the Windows system
- System must be joined to an Active Directory domain
- Active Directory Domain Services running on the local system or network
Requires local user accessAffects domain-joined systemsLow complexity exploitation
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply the 2026-September security update from Microsoft to all Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems
Long-term hardening
0/2HARDENINGRestrict local user account creation and logon to only trusted personnel; audit existing local accounts on domain-joined systems
HARDENINGImplement Group Policy restrictions to limit which user accounts can perform local logon and network access
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/9ac8c26c-462d-4451-8452-36ced87f930cGet OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.