CVE-2026-62762: Active Directory Domain Services DOS Flaw

CVE-2026-62762 Overview

CVE-2026-62762 is a null pointer dereference vulnerability [CWE-476] in Microsoft Active Directory Domain Services (AD DS). An authenticated attacker can trigger the flaw over the network to cause a denial of service condition against the affected domain controller. The vulnerability requires valid credentials but no user interaction, and it does not expose confidentiality or integrity of data. Successful exploitation disrupts directory services that depend on AD DS for authentication, authorization, and Group Policy processing. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).

Critical Impact
An authenticated network attacker can crash or hang Active Directory Domain Services, disrupting authentication, Kerberos, LDAP, and replication across the enterprise domain.

Affected Products

Microsoft Active Directory Domain Services (AD DS)
Windows Server deployments running the AD DS role
Domain controllers exposed to authenticated network clients

Discovery Timeline

2026-09-08 - CVE-2026-62762 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-62762

Vulnerability Analysis

The issue is a null pointer dereference within Active Directory Domain Services. AD DS fails to validate a pointer before dereferencing it during the handling of a specific authenticated network request. When the pointer is null, the process accesses invalid memory and terminates, producing a denial of service condition on the domain controller.

The attacker must hold valid domain credentials but does not need elevated privileges. Because AD DS underpins Kerberos ticket issuance, LDAP queries, and directory replication, an outage on one or more domain controllers can cascade to authentication failures across dependent services. The Common Weakness Enumeration classification is [CWE-476], Null Pointer Dereference.

Root Cause

The root cause is missing validation of a pointer prior to use in an AD DS code path reachable by an authenticated remote client. Microsoft has not published the specific function or protocol handler involved. See the Microsoft Security Update Guide entry for CVE-2026-62762 for vendor-provided technical detail.

Attack Vector

Exploitation occurs over the network against ports exposed by AD DS, typically LDAP (389/636), Kerberos (88), and RPC endpoints on domain controllers. An attacker with any authenticated domain account sends a crafted request that reaches the vulnerable code path. The domain controller process dereferences a null pointer and the affected service becomes unavailable until it is restarted or automatically recovers.

No public proof-of-concept exploit code is available at the time of publication. Consult the vendor advisory for verified technical details rather than synthetic examples.

Detection Methods for CVE-2026-62762

Indicators of Compromise

Unexpected crashes or restarts of the lsass.exe or ntds.dit-related services on domain controllers
Windows Event Log entries indicating Active Directory Domain Services stopped responding, including Directory Service event source errors
Sudden spikes in Kerberos and LDAP failures across dependent applications following authenticated LDAP or RPC traffic from a single principal

Detection Strategies

Monitor Windows Event Logs on domain controllers for service crash events, particularly source NTDS, Directory-Services-SAM, and application crash events referencing AD DS binaries
Correlate authentication anomalies with inbound LDAP, Kerberos, and RPC traffic patterns to identify a single source triggering repeated DC failures
Track domain controller availability with synthetic LDAP bind checks and Kerberos AS-REQ probes to detect service degradation early

Monitoring Recommendations

Enable verbose auditing on domain controllers for directory service access and account logon events
Forward domain controller telemetry to a centralized SIEM for cross-DC correlation of crashes and authentication failures
Alert on repeated authenticated LDAP or RPC operations from a single account preceding service termination events

How to Mitigate CVE-2026-62762

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62762 to all domain controllers
Prioritize patching internet-adjacent or multi-tenant domain controllers where authenticated access is broader
Review and reduce the population of accounts with unnecessary domain authentication rights

Patch Information

Microsoft has published a security update through the Microsoft Security Update Guide. Administrators should identify the applicable Knowledge Base article for each Windows Server version running the AD DS role and deploy the update following standard domain controller change control procedures. Reboot domain controllers as required by the update.

Workarounds

Restrict network access to domain controller LDAP, Kerberos, and RPC ports to trusted management and client subnets using host and network firewalls
Enforce account lockout and rate limiting on authentication endpoints to slow repeated exploitation attempts
Ensure sufficient domain controller redundancy across sites so a single DC outage does not disrupt authentication services

bash

# Example: restrict inbound LDAP to a management subnet on a domain controller
New-NetFirewallRule -DisplayName "Restrict LDAP to Mgmt" -Direction Inbound `
  -Protocol TCP -LocalPort 389,636 -RemoteAddress 10.10.0.0/24 -Action Allow
New-NetFirewallRule -DisplayName "Block Other LDAP" -Direction Inbound `
  -Protocol TCP -LocalPort 389,636 -Action Block