CVE-2026-50366: Windows 10 1607 DOS Vulnerability

CVE-2026-50366 Overview

CVE-2026-50366 is a null pointer dereference vulnerability [CWE-476] in Microsoft Active Directory Domain Services (AD DS). An authenticated attacker can send crafted requests over the network to trigger the flaw and cause a denial of service condition on the affected domain controller. The vulnerability affects a wide range of Microsoft Windows client and server operating systems, including Windows Server 2012 through Windows Server 2025 and Windows 10 and 11 across multiple builds.

Critical Impact
Successful exploitation causes AD DS to crash, disrupting authentication, group policy, and directory operations for every dependent user and service in the domain.

Affected Products

Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64
Microsoft Windows 11 (24H2, 25H2, 26H1) across x64 and ARM64

Discovery Timeline

2026-07-14 - CVE-2026-50366 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-50366

Vulnerability Analysis

Active Directory Domain Services processes directory requests from authenticated principals over network protocols such as LDAP and RPC. CVE-2026-50366 stems from a null pointer dereference inside the AD DS service. When the vulnerable code path receives a specific request, it dereferences a pointer without confirming the underlying object was successfully allocated or initialized. The invalid access terminates the AD DS worker process and disrupts directory operations across the domain.

The flaw impacts the availability of core identity services. Authentication requests, Kerberos ticket issuance, LDAP queries, and Group Policy replication all rely on AD DS. When the service crashes, dependent workloads including Exchange, SQL Server authentication, and federated applications fail until the domain controller recovers.

Root Cause

The root cause is missing validation of a pointer before dereference [CWE-476] within AD DS request handling. Microsoft has not published detailed source-level analysis. Consult the Microsoft Security Advisory CVE-2026-50366 for vendor-supplied technical details.

Attack Vector

The attack vector is network-based and requires valid domain credentials. An attacker authenticates to Active Directory using any low-privileged account, then sends a malformed directory request to a domain controller. No user interaction is required. The vulnerability does not disclose data or allow modification, but repeated exploitation can keep AD DS offline and effectively deny domain services across the environment.

No verified public proof-of-concept code is available. See the vendor advisory for exploitation prerequisites.

Detection Methods for CVE-2026-50366

Indicators of Compromise

Unexpected termination or restart of the NTDS (Active Directory Domain Services) service on domain controllers
Windows Error Reporting entries or crash dumps referencing lsass.exe or ntdsai.dll with access violation exceptions
Bursts of failed LDAP or RPC operations originating from a single authenticated principal followed by service unavailability

Detection Strategies

Monitor Windows Event Log for Service Control Manager events 7031 and 7034 tied to the NTDS or Active Directory Domain Services service
Correlate LDAP bind and search activity from Directory Service event logs with subsequent domain controller crashes
Baseline normal LDAP query volumes per user account and alert on anomalous request patterns preceding service disruption

Monitoring Recommendations

Enable and forward Directory Service, System, and Application event logs from all domain controllers to a centralized SIEM
Track availability metrics for AD DS ports (LDAP 389, LDAPS 636, GC 3268, Kerberos 88) to detect repeated outages
Retain lsass.exe crash dumps for forensic analysis and correlation with authenticated session telemetry

How to Mitigate CVE-2026-50366

Immediate Actions Required

Apply the July 2026 Microsoft security update referenced in the Microsoft Security Advisory CVE-2026-50366 to all domain controllers
Prioritize patching internet-adjacent and multi-tenant domain controllers first
Audit accounts with domain authentication rights and disable stale or unnecessary credentials that could be abused to trigger the flaw

Patch Information

Microsoft has released cumulative security updates addressing CVE-2026-50366 for all supported versions of Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and Windows 10 and 11. Refer to the vendor advisory for the specific KB article and package for each build. Reboot domain controllers in a staggered pattern to preserve directory availability during rollout.

Workarounds

Restrict LDAP and RPC access to domain controllers using network segmentation and firewall rules that only permit trusted subnets
Enforce LDAP channel binding and signing to reduce the population of principals able to submit crafted requests
Configure automatic recovery for the NTDS service through Service Control Manager so a crashed domain controller restores availability quickly while patches are deployed

bash

# Configure automatic restart of the AD DS service on failure
sc.exe failure "NTDS" reset= 86400 actions= restart/60000/restart/60000/restart/60000

# Verify the current recovery configuration
sc.exe qfailure "NTDS"