CVE-2026-69809

CVE-2026-69809 is a use-after-free-style memory leak (CWE-401) in Microsoft's Active Directory Domain Services, where allocated memory is not released after its effective lifetime. An unauthenticated remote attacker can trigger the flaw by sending network traffic to a domain controller, causing memory to accumulate until the service is exhausted. The impact is denial of service only — no confidentiality or integrity compromise — but the availability impact is rated high, meaning a domain controller can become unresponsive or need restarting. Any organization running the AD DS role on affected Windows Server releases is potentially affected, since the attack requires only network reachability to the DC, not credentials or user interaction. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a modest 1.1% probability of exploitation within 30 days; it was fixed in Microsoft's September 2026 Patch Tuesday release.

What to do: Apply the September 2026 cumulative Windows Server security updates to all domain controllers, prioritizing DCs reachable from untrusted networks (VPN, DMZ, or internet-exposed LDAP/Kerberos endpoints). Until patched, restrict network access to domain controllers to trusted sources where possible, since the DoS requires only unauthenticated network reachability. Check your environment for exposed DC services and monitor Microsoft's advisory for the definitive affected-version list.