Windows Active Directory Domain Services Denial of Service Vulnerability
MonitorCVSS 6.5CVE-2026-83667Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
An out-of-bounds read vulnerability in Active Directory Domain Services allows an authorized attacker to cause a denial of service condition. The vulnerability exists in how AD processes certain network requests and can crash or hang the AD service, making domain authentication unavailable. Exploitation requires valid domain user credentials or equivalent network access to a Domain Controller.
What this means
What could happen
An authenticated user within your AD domain could trigger a crash or hang in Active Directory Domain Services, making domain authentication unavailable and preventing users from logging into workstations or accessing networked resources.
Who's at risk
This affects all organizations using Microsoft Windows domains with Active Directory Domain Services, including manufacturers running domain-joined HMIs, engineering workstations, and utility business systems. Any environment where users or systems authenticate to AD is at risk.
How it could be exploited
An attacker with valid domain credentials sends a malformed request to a Domain Controller over the network. The vulnerability causes an out-of-bounds read in AD processing, crashing the AD service and denying service to legitimate domain users and systems.
Prerequisites
- Valid domain user credentials or domain account access
- Network connectivity to a Domain Controller (port 389 LDAP or 636 LDAPS)
- Domain membership or ability to communicate with AD services
Remotely exploitableRequires valid domain credentials (low barrier in internal networks)Low complexity attackAffects availability of critical authentication infrastructurePatch available from vendor
Exploitability
Some exploitation risk — EPSS score 1.1%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Do now
0/1WORKAROUNDRestrict LDAP access to Domain Controllers using firewall rules to permit only authorized administrative workstations and services, not all domain members
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply October 2026 security updates to all Domain Controllers (Windows Server 2016, 2019, 2022, 2025)
All products
HOTFIXApply October 2026 security updates to Windows 10 and Windows 11 workstations that authenticate to the domain
Long-term hardening
0/1HARDENINGReview and enforce strong password policies and multi-factor authentication (MFA) for all domain user accounts to reduce credential compromise risk
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/cc1997d7-f0c0-4f1e-82b8-7631f0b0a2c8Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.