Windows Active Directory Domain Services Remote Code Execution Vulnerability
Plan PatchCVSS 8.1CVE-2026-69546Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary
A use-after-free memory vulnerability in Windows Active Directory Domain Services allows an unauthenticated attacker to execute code remotely over the network. The vulnerability affects Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025.
What this means
What could happen
An attacker could execute arbitrary code on domain controllers or member servers, potentially compromising authentication, gaining administrative access, or disrupting directory services that critical infrastructure equipment relies on for authentication and policy application.
Who's at risk
Organizations running Windows domain infrastructure, particularly utilities and critical infrastructure with Windows-based SCADA engineering workstations, HMIs, or PLCs that rely on Active Directory for authentication and group policy. Domain controllers and member servers running any supported version of Windows 10, 11, or Windows Server 2016/2019/2022/2025 are affected.
How it could be exploited
An attacker with network access to the Active Directory Domain Services port (typically TCP 389 or 636) can send a specially crafted network request to trigger the use-after-free condition, leading to code execution with the privileges of the LDAP service running on the target domain controller or member server.
Prerequisites
- Network access to Active Directory Domain Services ports (LDAP/TCP 389 or LDAPS/TCP 636)
- No authentication required
remotely exploitableno authentication requiredaffects domain infrastructure and authentication
Exploitability
Unlikely to be exploited — EPSS score 0.7%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDRestrict network access to Active Directory ports (TCP 389, 636) to only authorized domain member computers and administrative networks using firewall rules
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply the September 2026 security update (or later) to all Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems
All products
HARDENINGPrioritize patching domain controllers before member servers, as domain controllers are the primary targets and control authentication for the entire network
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/93136b68-aedb-4861-9e4e-9ddd3a64c992Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.