CVE-2026-69809: Active Directory Domain Services DoS Flaw

CVE-2026-69809 Overview

CVE-2026-69809 is a denial-of-service vulnerability in Microsoft Active Directory Domain Services (AD DS). The flaw stems from missing release of memory after effective lifetime, classified as [CWE-401]. An unauthenticated remote attacker can send crafted network traffic to a Domain Controller (DC) to exhaust available memory. Sustained exploitation can render authentication and directory services unavailable across the affected environment.

Critical Impact
Unauthenticated network attackers can disrupt Active Directory availability, halting authentication, Group Policy processing, and directory replication for downstream Windows services.

Affected Products

Microsoft Windows Server running Active Directory Domain Services
Domain Controllers exposing AD DS network endpoints
Refer to the Microsoft Security Update Guide for the authoritative build list

Discovery Timeline

2026-09-08 - CVE-2026-69809 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-69809

Vulnerability Analysis

CVE-2026-69809 is a memory leak in Active Directory Domain Services. The affected code path allocates memory during request processing but fails to free it after the associated operation completes. Each malicious or malformed request retains a small memory footprint on the Domain Controller. Over time, repeated requests grow the resident working set until the LSASS process or the host itself exhausts available memory.

The vulnerability produces an availability impact only. It does not disclose data or permit code execution. The consequence is service disruption to authentication, LDAP queries, Kerberos ticket issuance, and replication traffic that depend on AD DS.

Root Cause

The root cause is a resource management defect mapped to [CWE-401]: Missing Release of Memory after Effective Lifetime. A code path in AD DS allocates heap memory for request state but omits the corresponding free operation on one or more exit branches. Because AD DS is a long-running system service, leaked allocations accumulate across the process lifetime rather than being reclaimed at request boundaries.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with reachability to a Domain Controller sends repeated requests to the vulnerable AD DS interface. Each request contributes to memory growth on the target. The attacker can amplify impact by parallelizing requests from multiple sources against a single DC. No exploit code or public proof of concept is currently listed in the NVD entry.

See the Microsoft Security Update Guide for the vendor description of triggering conditions.

Detection Methods for CVE-2026-69809

Indicators of Compromise

Sustained growth of the LSASS working set on Domain Controllers without a corresponding increase in legitimate directory workload.
Repeated inbound connections to AD DS ports (LDAP 389/636, Kerberos 88, RPC 135, dynamic RPC range) from a small set of source addresses.
Domain Controller event log entries indicating low memory, allocation failures, or LSASS instability preceding authentication failures.

Detection Strategies

Baseline LSASS memory usage per Domain Controller and alert on deviations that persist beyond normal daily peaks.
Correlate spikes in AD DS request rates from non-domain-joined or unexpected source IPs with memory growth on the target DC.
Monitor Windows Performance Counters for Process(lsass)\Private Bytes and Memory\Available MBytes on all DCs.

Monitoring Recommendations

Forward Domain Controller Security, System, and Directory Service logs to a centralized analytics platform for cross-DC correlation.
Enable network flow logging on segments containing Domain Controllers to identify unauthorized clients issuing directory traffic.
Alert on Service Control Manager events showing LSASS or NTDS service restarts, which may indicate exploitation attempts.

How to Mitigate CVE-2026-69809

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to every Domain Controller in the forest.
Restrict inbound access to AD DS ports so that only trusted subnets and management systems can reach Domain Controllers.
Verify Domain Controller monitoring is active and alert thresholds for memory pressure are tuned before patch rollout.

Patch Information

Microsoft has published the fix through its standard monthly update channel. Consult the Microsoft Security Update Guide for the specific Windows Server build numbers and KB identifiers that resolve CVE-2026-69809. Apply updates during a maintenance window and reboot Domain Controllers to complete installation.

Workarounds

Place network access control lists between untrusted networks and Domain Controllers to reduce reachable attack surface.
Distribute authentication load across multiple Domain Controllers so that a leak on one DC does not immediately disrupt the site.
Schedule proactive restarts of impacted Domain Controllers if patching cannot be completed immediately, to reclaim leaked memory.

bash

# Example: restrict inbound AD DS traffic on a Domain Controller to a trusted management subnet
New-NetFirewallRule -DisplayName "Restrict LDAP to Mgmt Subnet" `
  -Direction Inbound -Protocol TCP -LocalPort 389,636 `
  -RemoteAddress 10.10.0.0/24 -Action Allow

New-NetFirewallRule -DisplayName "Block LDAP from Untrusted" `
  -Direction Inbound -Protocol TCP -LocalPort 389,636 `
  -RemoteAddress Any -Action Block