CVE-2024-49112

What it actually does

CVE-2024-49112 is a critical remote code execution vulnerability in the Windows LDAP implementation. A remote attacker can send specially crafted LDAP/CLDAP traffic to a vulnerable Windows system running LDAP services, most notably domain controllers, and potentially cause execution of attacker-controlled code in the context of the LDAP service process. Because LDAP on Windows is closely tied to Active Directory and LSASS, successful exploitation can provide a path to high-privilege code execution on identity infrastructure without requiring normal interactive access.

Why it matters to the business

Compromise of Windows LDAP services can directly threaten Active Directory domain controllers and identity services, which are foundational to authentication, authorization, and business operations. A successful attack could allow attackers to take control of domain infrastructure, disrupt logons, deploy malware, create or modify privileged accounts, and move rapidly across the enterprise. The CVSS score is critical at 9.8 and the EPSS score is high at approximately 0.71, indicating meaningful likelihood of exploitation despite no CISA KEV listing at this time. Because the vulnerability has been public for over 600 days, organizations should assume it is well understood by attackers and prioritize remediation of exposed or unpatched Windows LDAP servers.

How an attack unfolds

An attacker first identifies Windows systems exposing LDAP or CLDAP services, especially domain controllers reachable over TCP or UDP port 389 or LDAPS over TCP port 636. The attacker then sends malformed or specially crafted LDAP-related requests designed to trigger the vulnerable code path in the Windows LDAP service. If exploitation succeeds, the attacker may gain code execution in a highly privileged service context associated with directory services. From there, the attacker can attempt to dump credentials, modify directory objects, add privileged users, disable security controls, deploy persistence, and use the compromised domain controller as a launch point for lateral movement. Even failed exploitation attempts may produce LSASS instability, LDAP service crashes, authentication disruptions, or unusual LDAP referral and CLDAP traffic patterns.

How to fix it

Apply the Microsoft security updates that address CVE-2024-49112 to all affected Windows systems, prioritizing domain controllers and any servers exposing LDAP, CLDAP, or LDAPS. Because no product-specific fixed versions were provided in the input, use the applicable Microsoft December 2024 or later cumulative security update for each supported Windows version. Remove unsupported Windows versions from service or isolate them if they cannot be patched. Restrict inbound LDAP/CLDAP/LDAPS access to trusted networks only, block unnecessary external access to TCP/389, UDP/389, TCP/636, and TCP/3268/3269, and ensure domain controllers are not reachable from untrusted networks. Where possible, enforce secure LDAP configurations, monitor and restrict LDAP referrals, and apply network segmentation around identity infrastructure. Mitigations should be treated as temporary controls; patching remains the primary fix.

How to confirm the fix worked

Confirm that all domain controllers and Windows LDAP servers have the relevant Microsoft security update installed by checking Windows Update history, installed cumulative update KBs, or enterprise patch management inventory. Validate that LDAP and CLDAP ports are not exposed to untrusted networks using authenticated vulnerability scanning and network reachability testing. Run vulnerability scanners with current Microsoft detection content to verify that CVE-2024-49112 is no longer reported. Confirm that domain controllers have been rebooted after patching where required. Review firewall rules and external attack surface scans to ensure TCP/389, UDP/389, TCP/636, TCP/3268, and TCP/3269 are not reachable from the internet unless explicitly required and protected.

Typical attack path

1. Scan for Windows hosts exposing LDAP, CLDAP, or LDAPS services, particularly domain controllers.
2. Confirm that the target appears to be running a vulnerable Windows LDAP implementation.
3. Send crafted LDAP or CLDAP requests intended to trigger the remote code execution condition.
4. Achieve code execution in the LDAP/LSASS service context or cause observable service instability if exploitation fails.
5. Run post-exploitation commands, deploy payloads, or establish persistence on the compromised server.
6. Access or manipulate Active Directory data, credentials, group memberships, or privileged accounts.
7. Use the compromised identity infrastructure to move laterally, escalate privileges, and expand control across the environment.

How to detect it

To determine whether exploitation may have already occurred, review domain controller and Windows server telemetry around the time of any suspicious LDAP activity. Focus on network logs for unusual inbound LDAP or CLDAP requests to TCP/389, UDP/389, TCP/636, TCP/3268, or TCP/3269, especially from untrusted or previously unseen sources. Inspect firewall, IDS, Zeek, NetFlow, and packet capture data for spikes in CLDAP traffic, malformed LDAP requests, or unexpected LDAP referral behavior. On Windows hosts, review System, Application, Security, Directory Service, and PowerShell logs for LSASS crashes, LDAP service instability, unexpected restarts, abnormal process creation, or post-exploitation activity. High-signal host indicators include lsass.exe spawning command shells or scripting engines, new or modified privileged Active Directory accounts, suspicious service creation, credential dumping behavior, and unexpected outbound connections from domain controllers. Correlate any LSASS fault events with inbound LDAP/CLDAP traffic from the same source IPs. If EDR telemetry is available, search for suspicious child processes of lsass.exe and any payloads written shortly after LDAP traffic anomalies.

• TCP/389
• UDP/389
• TCP/636
• TCP/3268
• TCP/3269
• lsass.exe
• Faulting application name: lsass.exe
• Faulting module name: wldap32.dll
• Faulting module name: ntdsai.dll
• The Local Security Authority process terminated unexpectedly
• Event ID 1000
• Event ID 1001
• Event ID 7031
• Event ID 7034
• Event ID 7045
• Event ID 4720
• Event ID 4728
• Event ID 4732
• Event ID 4756
• Event ID 4670
• Event ID 4662
• ParentImage: *\\lsass.exe
• Image: *\\cmd.exe ParentImage: *\\lsass.exe
• Image: *\\powershell.exe ParentImage: *\\lsass.exe
• Image: *\\wscript.exe ParentImage: *\\lsass.exe
• Image: *\\cscript.exe ParentImage: *\\lsass.exe
• Image: *\\rundll32.exe ParentImage: *\\lsass.exe
• Image: *\\regsvr32.exe ParentImage: *\\lsass.exe
• procdump.exe -ma lsass.exe
• comsvcs.dll, MiniDump
• sekurlsa::logonpasswords

What your security team should do

• Immediately inventory all Windows systems providing LDAP services, with highest priority on Active Directory domain controllers.
• Patch all affected systems with the applicable Microsoft cumulative security updates, prioritizing internet-reachable or cross-network-reachable LDAP services.
• Restrict LDAP, CLDAP, Global Catalog, and LDAPS traffic to trusted clients and administrative networks only.
• Block inbound UDP/389 and TCP/389 from untrusted networks unless there is a documented business requirement.
• Hunt for abnormal LDAP/CLDAP traffic, LSASS crashes, unexpected child processes from LSASS, and suspicious changes to privileged Active Directory groups.
• Increase monitoring on domain controllers for credential dumping, unauthorized directory changes, new privileged accounts, and anomalous replication or authentication activity.
• If exploitation is suspected, treat affected domain controllers as high-impact assets: isolate, preserve forensic evidence, rotate privileged credentials, and review Active Directory integrity.
• Because EPSS is high and the vulnerability has been public for a long period, track remediation through completion rather than accepting compensating controls alone.