Multiple Active Directory Vulnerabilities Let Attackers Bypass Security Feature Remotely
Microsoft disclosed three remote Active Directory security-feature bypass flaws, with no evidence of active exploitation.
Microsoft disclosed three Active Directory security-feature bypass vulnerabilities: CVE-2026-69982, CVE-2026-96252, and CVE-2026-108131. The flaws may let a remote attacker bypass controls in Windows domain environments without necessarily taking full control of a server. Microsoft’s accessible update information does not show these issues are being exploited. Administrators are urged to patch domain controllers, keep directory services off the public internet, and monitor authentication and privilege changes.
68