Use-After-Free Remote Code Execution in Microsoft Active Directory Domain Services
AI analysis
CVE-2026-69524 is a use-after-free memory corruption flaw (CWE-416) in Microsoft's Active Directory Domain Services (AD DS), patched as part of Microsoft's September 2026 Patch Tuesday release. An unauthorized attacker with no privileges or user interaction can trigger the flaw remotely over the network, though the high attack-complexity rating suggests reliable exploitation may depend on favorable memory or timing conditions. A successful exploit yields remote code execution on the target, with high impact to confidentiality, integrity, and availability — typically a domain controller holding an organization's central authentication data. Any organization running Windows Server with the AD DS role enabled (i.e., operating domain controllers) is affected. As of this data there are no known in-the-wild exploits, no public proof of concept, and a modest 0.7% EPSS probability of exploitation within 30 days.
What to do: Apply Microsoft's September 2026 security updates to all Windows Servers running the AD DS role, prioritizing domain controllers, and confirm the affected Windows Server builds against Microsoft's advisory. Until patched, restrict network access to domain controllers — avoid exposing LDAP/Kerberos endpoints to untrusted networks or the internet — and monitor for signs of anomalous activity against DCs.
Affected
| Microsoft Windows Server with Active Directory Domain Services (AD DS) role | — |
Estimated exposure
mass≈ millions of domain controllers worldwide (AD DS is the default directory service in Windows enterprise networks) — AD DS is deployed by virtually every Windows-based organization, typically with multiple domain controllers per environment, putting the global count of potentially affected systems well over 100,000, though DCs are usually internal rather…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.