CVE-2026-88165: Active Directory Domain Services RCE Vulnerability

CVE-2026-88165 Overview

CVE-2026-88165 is an out-of-bounds write vulnerability [CWE-787] in Microsoft Active Directory Domain Services (AD DS). An authenticated attacker can trigger the flaw over a network to execute arbitrary code in the context of the directory service. Successful exploitation compromises the confidentiality, integrity, and availability of the targeted domain controller.

Because AD DS underpins authentication and authorization across Windows enterprises, code execution on a domain controller provides a path to full domain compromise. Microsoft published the advisory on 2026-10-13 and tracks the issue through its Security Update Guide.

Critical Impact

An authenticated network attacker can execute arbitrary code within Active Directory Domain Services, enabling domain-wide compromise and lateral movement across identity infrastructure.

Affected Products

• Microsoft Active Directory Domain Services (AD DS)
• Windows Server deployments running the AD DS role (refer to the Microsoft advisory for specific build numbers)
• Domain controllers exposing AD DS over the network

Discovery Timeline

• 2026-10-13 - CVE-2026-88165 published to the National Vulnerability Database
• 2026-10-13 - Last updated in the NVD database

Technical Details for CVE-2026-88165

Vulnerability Analysis

The flaw is an out-of-bounds write within Active Directory Domain Services. AD DS processes crafted input and writes past the bounds of an allocated memory buffer. The out-of-bounds write corrupts adjacent memory structures, enabling control-flow hijacking and arbitrary code execution.

Exploitation requires low-privilege authenticated access and no user interaction. The attacker reaches the vulnerable code path over the network, typically through directory service protocols exposed by a domain controller. A successful write primitive leads to code execution in a highly privileged service context.

According to Microsoft's advisory, the vulnerability affects supported Windows Server versions that host the AD DS role. The Exploit Prediction Scoring System (EPSS) places exploitation likelihood at 0.851% with a 57.311 percentile ranking as of 2026-10-14.

Root Cause

The root cause is improper validation of input length or offset calculations when AD DS handles network-supplied directory data. The service writes attacker-controlled bytes beyond an intended buffer boundary, which satisfies the classic definition of [CWE-787] Out-of-bounds Write. Memory corruption in a service running with SYSTEM-equivalent privileges on a domain controller produces the observed impact.

Attack Vector

The attack vector is network-based. An authenticated principal, even one with low privileges in the directory, can send crafted requests to the domain controller to trigger the vulnerable code path. No user interaction is required. Because any domain-joined account typically can bind and issue directory queries, the preconditions are commonly satisfied in production Active Directory environments.

No verified public proof-of-concept exploit is available at the time of publication. See the Microsoft Security Update Guide CVE-2026-88165 for authoritative technical detail.

Detection Methods for CVE-2026-88165

Indicators of Compromise

• Unexpected lsass.exe or AD DS process crashes, hangs, or restarts on domain controllers.
• New or anomalous child processes spawned by directory service processes on a domain controller.
• Creation of unexpected privileged accounts, group membership changes, or replication anomalies following suspicious LDAP or RPC traffic.

Detection Strategies

• Monitor domain controller event logs for service failures and Windows Error Reporting entries involving directory service binaries.
• Correlate authenticated LDAP, SAMR, or DRSUAPI traffic from unusual sources with subsequent domain controller process anomalies.
• Baseline normal AD replication and authentication patterns, then alert on deviations consistent with memory corruption attempts.

Monitoring Recommendations

• Enable advanced audit policies for directory service access and object changes on all domain controllers.
• Forward domain controller telemetry to a centralized analytics platform for cross-host correlation.
• Track Microsoft advisory updates for CVE-2026-88165 and verify patch deployment status across the AD DS fleet.

How to Mitigate CVE-2026-88165

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft Security Update Guide CVE-2026-88165 to all domain controllers.
• Prioritize patching domain controllers that are reachable from less-trusted network segments or user workstations.
• Audit privileged and standard domain accounts for suspicious authentication activity preceding and following patch deployment.

Patch Information

Microsoft released fixes through its October 2026 Security Update Guide entry for CVE-2026-88165. Administrators should install the updates on every writable and read-only domain controller, then reboot to complete the patch. Confirm installation by reviewing update history and running Get-HotFix or equivalent inventory checks across the AD DS environment.

Workarounds

• Restrict network access to domain controller LDAP, RPC, and SMB endpoints using host-based and network firewalls where operationally feasible.
• Enforce tiered administration and limit which accounts can authenticate to domain controllers until patches are applied.
• Monitor directory service processes for abnormal behavior if immediate patching is not possible, and expedite the maintenance window.

# Verify installation of the relevant security update on a domain controller
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Restrict inbound LDAP/RPC exposure to trusted management subnets (example)
New-NetFirewallRule -DisplayName "Restrict LDAP to Mgmt" -Direction Inbound -Protocol TCP -LocalPort 389,636 -RemoteAddress 10.0.0.0/24 -Action Allow