CVE-2026-54119 Overview
CVE-2026-54119 is a denial-of-service vulnerability in Windows Active Directory caused by a loop with an unreachable exit condition [CWE-835]. An unauthenticated remote attacker can send crafted network traffic that forces the affected service into an infinite loop, exhausting CPU resources and rendering the directory service unresponsive. The flaw affects all currently supported Windows client and server versions, including domain controllers running Windows Server 2012 through Windows Server 2025.
Critical Impact
An unauthenticated network attacker can trigger a sustained denial of service against Active Directory infrastructure, disrupting authentication, group policy, and directory-dependent services across an entire domain.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
- Domain controllers and member servers running the Active Directory role on the versions above
Discovery Timeline
- 2026-07-14 - CVE-2026-54119 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-54119
Vulnerability Analysis
The vulnerability resides in the Windows Active Directory service processing path and is classified as CWE-835, a loop with an unreachable exit condition. When the service parses a specific malformed request over the network, control flow enters a loop whose termination condition can never be satisfied. The thread handling the request consumes CPU cycles indefinitely, and repeated requests can starve worker threads used for LDAP, Kerberos, and replication operations.
Because Active Directory underpins authentication and authorization across the domain, a single unresponsive domain controller can cascade into logon failures, group policy application errors, and stalled replication. The vulnerability does not disclose data or allow modification of directory content, but availability impact is high across dependent services.
Root Cause
The root cause is improper validation of input that governs a loop iterator or termination predicate within the Active Directory request handler. A malformed value bypasses the intended exit path, and the loop continues without progress. No credentials or user interaction are required to reach the vulnerable code path.
Attack Vector
Exploitation occurs over the network against the ports exposed by Active Directory services, typically LDAP (389/636), Global Catalog (3268/3269), and related RPC endpoints. An attacker with network reachability to a domain controller sends the crafted request and requires no authentication. Repeating the request across all available worker threads produces a sustained outage of directory services.
No public proof-of-concept code has been released for this issue. Refer to the Microsoft Security Advisory CVE-2026-54119 for vendor technical details.
Detection Methods for CVE-2026-54119
Indicators of Compromise
- Sustained 100% CPU utilization on lsass.exe or Active Directory worker threads on domain controllers without a corresponding legitimate workload
- Spikes in unfinished LDAP or RPC requests from a single or small set of source IP addresses
- Domain controller unresponsiveness to authentication and replication requests while the host remains network reachable
Detection Strategies
- Monitor domain controller performance counters for anomalous, sustained CPU consumption tied to directory service processes
- Inspect network telemetry for unusual volumes or patterns of LDAP, Global Catalog, or RPC traffic originating from non-administrative subnets
- Correlate Windows Event Log entries for Directory Service warnings and errors with source IP data from network sensors
Monitoring Recommendations
- Enable and centrally collect Directory Service, LDAP interface, and NTDS diagnostic logs for baseline and anomaly analysis
- Alert on repeated authentication or replication timeouts across multiple clients pointing to the same domain controller
- Track the availability of LDAP and Kerberos endpoints via synthetic transactions from a monitoring platform
How to Mitigate CVE-2026-54119
Immediate Actions Required
- Apply the security update referenced in the Microsoft Security Advisory CVE-2026-54119 to all domain controllers and affected Windows systems as soon as possible
- Prioritize patching internet-exposed or DMZ-adjacent domain controllers and any read-only domain controllers accepting untrusted client traffic
- Verify domain controller redundancy so that a single unavailable server does not disrupt authentication during the patch cycle
Patch Information
Microsoft has published the fix through its standard security update channels. Consult the Microsoft Security Advisory CVE-2026-54119 for the specific KB article, build numbers, and deployment guidance for each affected Windows version. Reboot domain controllers as directed to ensure the updated Active Directory service binaries load.
Workarounds
- Restrict network access to LDAP (389/636), Global Catalog (3268/3269), and Active Directory RPC ports to trusted management and member subnets only
- Place domain controllers behind segmentation controls that block untrusted or internet-sourced traffic from reaching directory service ports
- Increase monitoring sensitivity on directory service CPU and thread metrics so a triggered condition can be detected and remediated quickly
# Example: restrict inbound LDAP/GC traffic to a trusted management subnet on a Windows DC
New-NetFirewallRule -DisplayName "Restrict LDAP to Mgmt" -Direction Inbound -Protocol TCP `
-LocalPort 389,636,3268,3269 -RemoteAddress 10.10.0.0/24 -Action Allow
New-NetFirewallRule -DisplayName "Block LDAP from Untrusted" -Direction Inbound -Protocol TCP `
-LocalPort 389,636,3268,3269 -RemoteAddress Any -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
