CVE-2026-69359

CVE-2026-69359 is a heap-based buffer overflow (CWE-122) in Microsoft's Active Directory Domain Services (AD DS), patched as part of Microsoft's September 2026 Patch Tuesday, which addressed 966 flaws including 2 zero-days. An attacker who already holds a low-privileged authorized account on a system running the AD DS role (typically a domain controller) can trigger the overflow locally; per the CVSS vector the attack requires no user interaction and no remote access. Successful exploitation yields local elevation of privilege with high impact on confidentiality, integrity, and availability — on a domain controller this means the attacker gains elevated rights on the host that effectively expose the directory service itself. Any organization operating AD DS on Windows Server domain controllers is potentially affected. There is currently no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns a low 0.3% probability of exploitation within 30 days; whether this CVE is one of the two actively exploited zero-days reported in the September 2026 release is not stated in the available data.

What to do: Apply Microsoft's September 2026 Patch Tuesday security updates for Windows Server/AD DS as soon as possible, prioritizing domain controllers. In the interim, restrict interactive logon, RDP, and remote management rights on domain controllers to trusted administrators, since exploitation requires an authorized local account. Given no known public exploit and low EPSS (0.3%), treat this as routine patch prioritization rather than an emergency, but include all domain controllers in the patch wave.