CVE-2026-50682: Windows Active Directory DOS Vulnerability

CVE-2026-50682 Overview

CVE-2026-50682 is an out-of-bounds read vulnerability [CWE-125] affecting Windows Active Directory. An authorized attacker can send crafted network requests to trigger the flaw and cause a denial-of-service condition on the affected domain service. Microsoft published the advisory on July 14, 2026.

The vulnerability requires low privileges and no user interaction to exploit over the network. Successful exploitation impacts availability of Active Directory, which underpins authentication and authorization in Windows enterprise environments. The Exploit Prediction Scoring System (EPSS) rates the probability of exploitation at 0.89%.

Critical Impact
An authenticated attacker with low privileges can remotely disrupt Windows Active Directory services, affecting authentication and directory availability across the domain.

Affected Products

Microsoft Windows Active Directory (see the Microsoft Security Update Guide for specific build coverage)
Windows Server versions hosting the Active Directory Domain Services role
Domain controllers exposed to authenticated network clients

Discovery Timeline

2026-07-14 - CVE-2026-50682 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-50682

Vulnerability Analysis

CVE-2026-50682 is classified as an out-of-bounds read in Windows Active Directory. The flaw allows an authorized attacker to read memory beyond the intended buffer boundaries during processing of a network request. The condition causes the Active Directory service to terminate or become unresponsive, producing a denial-of-service outcome.

Domain controllers are high-value assets. Loss of Active Directory availability disrupts Kerberos authentication, Group Policy, LDAP queries, and downstream applications that depend on directory services. Microsoft has not released public technical details beyond the advisory to limit exploit development.

Root Cause

The underlying weakness is an out-of-bounds read [CWE-125]. Insufficient validation of a length or offset value in a directory service message handler allows the process to read past the end of an allocated buffer. The invalid read triggers an access violation that halts the service.

Attack Vector

Exploitation occurs over the network against a domain controller. The attacker must hold valid credentials with low privileges, such as a standard domain user account. No user interaction is required, and the attack complexity is low. Refer to the Microsoft Security Update Guide for protocol-level details when Microsoft releases them.

No verified proof-of-concept code is publicly available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-50682

Indicators of Compromise

Unexpected termination or restart of the lsass.exe or ntds service on domain controllers
Windows Event Log entries indicating access violations in the Active Directory Domain Services process
Repeated failed LDAP or RPC requests from a single authenticated source preceding a service crash
Sudden loss of authentication capability across the domain without configuration changes

Detection Strategies

Monitor domain controller availability and Active Directory service health using centralized telemetry
Correlate crash events with authenticated LDAP, RPC, or Kerberos activity from unusual accounts
Baseline normal directory query patterns and alert on anomalies from low-privilege accounts
Ingest domain controller logs into a security data lake for retrospective analysis across the environment

Monitoring Recommendations

Enable Windows Event Forwarding for Directory Service and System event logs on all domain controllers
Track process crashes with Event ID 1000 and service state changes with Event ID 7031 and 7034
Monitor sustained LDAP query volume from individual accounts using Event ID 1644
Alert on gaps in domain controller heartbeat and replication metrics

How to Mitigate CVE-2026-50682

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all domain controllers
Prioritize patching internet-adjacent and multi-tenant domain controllers first
Audit accounts with network access to domain controllers and revoke unnecessary standard user access
Verify domain controller redundancy so a single service crash does not disrupt authentication

Patch Information

Microsoft has released a security update addressing CVE-2026-50682. Administrators should install the corresponding cumulative update on every domain controller and verify installation with Get-HotFix or Windows Update logs. Refer to the Microsoft Security Update CVE-2026-50682 advisory for the exact KB identifiers matching each supported Windows Server version.

Workarounds

Restrict LDAP and RPC access to domain controllers using host-based and network firewalls where operationally feasible
Enforce least privilege for domain accounts to reduce the attacker population capable of triggering the flaw
Enable automatic service recovery for Active Directory Domain Services to reduce downtime after a crash
Increase monitoring sensitivity on domain controllers until patching is complete

bash

# Verify installation of the Microsoft security update on a domain controller
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Configure automatic recovery for the AD DS service
sc.exe failure NTDS reset= 86400 actions= restart/60000/restart/60000/restart/60000