CVE-2026-69546

CVE-2026-69546 is a use-after-free (CWE-416) memory corruption flaw in Microsoft's Active Directory Domain Services (AD DS), the directory service role that runs on Windows Server domain controllers. It can be triggered over the network by an unauthenticated attacker, although the high attack-complexity metric suggests exploitation requires favorable timing or conditions rather than a simple, repeatable request. Successful exploitation yields remote code execution on the domain controller with the confidentiality, integrity, and availability of the host all rated high, which in practice risks compromise of the identity infrastructure that underpins the entire domain. Any organization running the AD DS role on Windows Server is affected; the exact server builds are enumerated in Microsoft's September 2026 security updates. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns it roughly a 0.7% chance of exploitation within 30 days.

What to do: Apply the September 2026 Windows Server security updates to all domain controllers as a priority, since AD DS hosts are high-value targets even when the flaw is not yet exploited in the wild. Until patching, restrict network reachability of domain controllers to trusted management and authentication traffic and monitor for anomalous DC traffic. Note the high attack complexity means opportunistic exploitation is less likely, but treat the patch as urgent given domain-controller compromise cascades to the whole domain.