CVE-2026-57976 Overview
CVE-2026-57976 is a null pointer dereference vulnerability [CWE-476] in Microsoft Active Directory Domain Services (AD DS). An authenticated attacker can send crafted network requests to a domain controller and trigger a denial-of-service condition. The flaw affects a broad range of Windows client and Windows Server releases, including Windows Server 2012 through Windows Server 2025.
Exploitation requires only low-privilege network access and no user interaction. Successful attacks disrupt directory services, which impacts authentication, Group Policy processing, and dependent enterprise applications across the affected domain.
Critical Impact
An authenticated network attacker can crash Active Directory Domain Services on unpatched domain controllers, disrupting authentication and directory-dependent services enterprise-wide.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-07-14 - CVE-2026-57976 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-57976
Vulnerability Analysis
The vulnerability resides in Active Directory Domain Services, the core Windows role responsible for authentication, authorization, and directory data storage. AD DS fails to validate a pointer before dereferencing it while processing specific network requests. When the pointer is NULL, the process terminates and directory services become unavailable.
Because the attack targets a domain controller, the blast radius extends beyond the crashed host. Kerberos ticket issuance, LDAP queries, and replication traffic depend on AD DS availability. A single request path can therefore cascade into a domain-wide outage until the service restarts.
The issue is tracked as CWE-476: NULL Pointer Dereference. The EPSS probability is 0.755%, placing the CVE in the 51st percentile of exploit likelihood.
Root Cause
The root cause is missing pointer validation in the AD DS request handler. A code path processes attacker-influenced input and dereferences an object reference that can be uninitialized or unresolved. Without a null check, the dereference triggers an access violation inside the lsass.exe process context that hosts AD DS.
Attack Vector
The attack is network-based and requires an authenticated session against a domain controller. Any domain-joined user account with standard privileges satisfies the prerequisite. The attacker sends a malformed or unexpected directory service request that reaches the vulnerable code path.
No user interaction is required. The exploit produces no confidentiality or integrity impact, but availability loss on a domain controller is significant. See the Microsoft Security Update CVE-2026-57976 advisory for authoritative technical details.
Detection Methods for CVE-2026-57976
Indicators of Compromise
- Unexpected termination or restart of lsass.exe on domain controllers, often accompanied by Windows Event ID 1000 (Application Error) or 7031 (Service Control Manager) referencing the LSA subsystem.
- Sudden spikes in failed Kerberos and LDAP requests across the domain immediately following a crash.
- Directory Service event log entries indicating replication failure or NTDS shutdown following an inbound network request.
Detection Strategies
- Correlate crashes of directory service processes with authenticated LDAP or RPC connections originating from non-administrative accounts.
- Alert on repeated domain controller reboots or lsass.exe restarts within short time windows, which suggest attempted DoS iteration.
- Baseline normal LDAP query patterns and flag anomalous, malformed, or oversized directory service requests.
Monitoring Recommendations
- Forward Windows Security, System, and Directory Service event logs from all domain controllers to a centralized analytics platform for correlation.
- Monitor domain controller availability with synthetic Kerberos and LDAP transactions to detect service outages within seconds.
- Track authenticated sessions targeting AD DS from unusual source hosts, service accounts, or workstations outside expected admin tiers.
How to Mitigate CVE-2026-57976
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-57976 to all domain controllers as the primary remediation.
- Prioritize patching writable domain controllers before member servers and workstations, since the vulnerable role is AD DS.
- Audit domain accounts and disable dormant or unnecessary user accounts to reduce the pool of attackers that meet the authentication prerequisite.
Patch Information
Microsoft has released security updates for all affected Windows client and Windows Server versions. Refer to the Microsoft Security Update CVE-2026-57976 guidance for the specific KB article and build numbers that apply to each supported release. Reboot domain controllers as required to complete installation.
Workarounds
- No official workaround replaces the security update. Restrict network reachability to domain controllers using firewall rules that allow only trusted subnets to reach LDAP (389/636), Kerberos (88), and RPC endpoints.
- Enforce tiered administration and strong authentication so that fewer identities can reach AD DS interactively or over the network.
- Ensure domain controller redundancy across sites so that a single crashed controller does not eliminate authentication capability while patching is completed.
# Example: verify installed security update on a domain controller
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# Example: restrict inbound LDAP to trusted management subnet only
New-NetFirewallRule -DisplayName "Restrict LDAP to Mgmt" -Direction Inbound `
-Protocol TCP -LocalPort 389,636 -RemoteAddress 10.10.0.0/24 -Action Allow
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
