CVE-2026-62762

CVE-2026-62762 is a null pointer dereference (CWE-476) in Microsoft Active Directory Domain Services (AD DS), the directory service role that provides authentication and identity for Windows Server domains. An authorized, low-privileged user can trigger it remotely — with no user interaction and low attack complexity — by sending crafted network requests to a domain controller, causing the service to dereference a null pointer and crash. The impact is denial of service only (no confidentiality or integrity loss, per the CVSS 6.5 score with Availability:High), and because domain controllers are the authentication backbone of a domain, crashes can disrupt logons and dependent services across the environment. Any organization operating Windows Server domain controllers with the AD DS role is affected; the flaw was addressed in Microsoft's September 2026 Patch Tuesday, which fixed 966 flaws including 2 zero-days, though the data does not identify this CVE as one of the exploited zero-days. There is no known exploitation: no public proof-of-concept, not listed in CISA KEV, and only a modest 0.8% EPSS probability of exploitation within the next 30 days (percentile 53).

What to do: Apply Microsoft's September 2026 security updates for AD DS/Windows Server to every domain controller, including remote, branch, and lab DCs, as part of this month's Patch Tuesday rollout. Until patched, restrict which authenticated accounts and hosts can reach domain controllers over directory protocols such as LDAP, and avoid exposing DCs directly to the internet. After patching, review domain controller event logs for crashes or unexpected service restarts that could indicate probing or attempted exploitation.