CVE-2026-69546: Active Directory Use After Free Vulnerability

CVE-2026-69546 Overview

CVE-2026-69546 is a use-after-free vulnerability [CWE-416] in Microsoft Active Directory Domain Services (AD DS). An unauthenticated attacker can exploit the flaw over the network to execute arbitrary code on the affected domain controller. Microsoft published the advisory on 2026-09-08. The vulnerability requires no privileges and no user interaction, but has high attack complexity, meaning successful exploitation depends on winning a race or meeting specific runtime conditions. Compromise of a domain controller through this flaw can lead to full Active Directory takeover.

Critical Impact
Successful exploitation permits unauthenticated remote code execution on Active Directory Domain Services, exposing the entire domain to compromise.

Affected Products

Microsoft Active Directory Domain Services (see Microsoft advisory for specific Windows Server builds)
Windows Server installations operating in the Domain Controller role
Environments exposing AD DS network services to untrusted networks

Discovery Timeline

2026-09-08 - CVE-2026-69546 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-69546

Vulnerability Analysis

The vulnerability is a use-after-free condition inside Active Directory Domain Services. AD DS retains a reference to a memory object after that object has been freed. Subsequent access to the dangling pointer allows an attacker to influence the contents of the freed allocation and redirect execution flow.

Exploitation is network-reachable and requires no authentication or user interaction. The high attack complexity indicates a race window or specific object-state manipulation is needed to reliably trigger the freed allocation reuse. When successful, the attacker executes code in the security context of the AD DS process on the domain controller.

Root Cause

The root cause is improper object lifetime management in an AD DS request-handling path. A code path frees an object without invalidating all references to it, enabling later dereference of stale memory. The CWE-416 classification confirms this is a classic use-after-free pattern rather than a bounds or validation flaw.

Attack Vector

The attacker sends crafted requests to AD DS network endpoints exposed by the domain controller. By interleaving requests that free and then reuse the target object, the attacker triggers the dangling pointer dereference. Controlled data placed in the reclaimed allocation redirects execution to attacker-supplied logic. Public technical details are not available. Refer to the Microsoft Security Update for CVE-2026-69546 for authoritative information.

Detection Methods for CVE-2026-69546

Indicators of Compromise

Unexpected crashes, access violations, or restarts of the lsass.exe or AD DS-related processes on domain controllers
Anomalous inbound traffic patterns to AD DS ports (LDAP 389/636, Global Catalog 3268/3269, RPC 135, and dynamic RPC endpoints) from unusual source hosts
New or unexpected child processes spawned by domain controller service accounts
Creation of unauthorized privileged accounts, group memberships, or replication activity following suspicious network traffic

Detection Strategies

Monitor Windows Error Reporting and crash dumps on domain controllers for repeated faults in AD DS components, which can indicate failed exploitation attempts
Correlate LDAP and RPC traffic volume with authentication baselines to surface unauthenticated request bursts targeting AD DS
Alert on directory service replication or schema changes originating outside change-management windows

Monitoring Recommendations

Enable Directory Service auditing (Event IDs 4662, 5136, 5137, 5141) and forward logs to a centralized analytics platform
Collect Sysmon process, network, and image-load telemetry from all domain controllers
Baseline outbound connections from domain controllers and alert on any deviation, since DCs should rarely initiate arbitrary egress

How to Mitigate CVE-2026-69546

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory to all domain controllers as a priority patch cycle
Inventory all domain controllers and confirm patch deployment status through configuration management tooling
Restrict network reachability of AD DS services to trusted management and member-server subnets
Review domain controller logs for signs of exploitation attempts prior to patching

Patch Information

Microsoft has issued a security update. Consult the Microsoft Security Update for CVE-2026-69546 for the specific KB articles, affected builds, and installation guidance. Reboot domain controllers after installation to complete remediation.

Workarounds

Segment domain controllers behind firewalls that permit AD DS protocols only from authorized subnets
Block direct internet exposure of LDAP, LDAPS, RPC, and Global Catalog ports
Enforce tiered administration so that any post-exploitation lateral movement is constrained by privilege boundaries
Prioritize patching over workarounds; network controls reduce but do not eliminate risk from insider or foothold-based attackers

bash

# Verify installed updates on a domain controller (PowerShell)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# List domain controllers to confirm patch coverage
Get-ADDomainController -Filter * | Select-Object HostName, OperatingSystem, Site