Windows Active Directory Domain Services Denial of Service Vulnerability
MonitorCVSS 6.5CVE-2026-83648Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A null pointer dereference in Active Directory Domain Services allows an authorized attacker to cause a denial of service by crashing the service on domain controllers. The attack requires valid domain account credentials and network access to LDAP ports. Microsoft has released patches for all affected Windows versions.
What this means
What could happen
An attacker with valid domain credentials could crash the Active Directory service on domain controllers, making authentication and user lookups unavailable until the service restarts.
Who's at risk
Windows domain controllers and servers running Active Directory Domain Services across Windows Server 2022, 2025, and Windows 10/11 editions. Relevant to any organization using Active Directory for user authentication and directory services, including municipal utilities and water authorities with networked infrastructure.
How it could be exploited
An attacker with valid domain account credentials sends a specially crafted network request to Active Directory Domain Services on a domain controller, triggering a null pointer dereference that crashes the service.
Prerequisites
- Valid domain user account credentials
- Network access to port 389 (LDAP) or port 636 (LDAPS) on domain controllers
remotely exploitablerequires valid domain credentialsaffects directory services availability
Exploitability
Some exploitation risk — EPSS score 1.1%
Affected products (20)
20 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXInstall the October 2026 security update for all domain controllers and Windows servers running Active Directory Domain Services
Long-term hardening
0/2HARDENINGReview and enforce strong password policies to limit the number of accounts with unnecessary domain access
HARDENINGMonitor domain controller Event Viewer logs (Event ID 1000) for unexpected crashes in Active Directory services
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/4fe78744-e678-4e90-98bc-ca267a3cde3cGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.