CVE-2026-45648

What it actually does

This is a network-reachable stack-based buffer overflow in Active Directory Domain Services on affected Windows Server 2022 and Windows Server 2025 systems. An authenticated attacker with low privileges can send a crafted request to AD DS and corrupt stack memory, potentially gaining control of execution flow and running arbitrary code in the context of the directory service process. Because AD DS is a core domain controller service, successful exploitation could lead to full compromise of the domain controller, including access to directory data, credential material, security principals, and domain policy controls.

Why it matters to the business

A compromised domain controller can become a compromise of the entire Windows domain. Business consequences may include unauthorized access to sensitive systems, creation of persistent privileged accounts, theft of credentials, disruption of authentication services, policy tampering, ransomware staging, and loss of trust in directory identity infrastructure. Although this issue is not currently listed in CISA KEV, has no reported ransomware association, and has a low EPSS score, the CVSS severity is high and the affected component is highly privileged, so organizations should treat exposure on domain controllers as a priority.

How an attack unfolds

An attacker first obtains valid domain credentials, which may be a low-privileged account. From a network position that can reach a domain controller, the attacker sends specially crafted AD DS traffic to the vulnerable service. The malformed input triggers a stack-based buffer overflow, allowing the attacker to alter process control flow and execute code on the domain controller. If successful, the attacker can run commands under the security context of the affected service, tamper with directory objects, extract credential material, create or modify privileged accounts, deploy persistence, and move laterally across systems that trust the domain.

How to fix it

Apply Microsoft security updates for affected Windows Server 2022 and Windows Server 2025 domain controllers as soon as vendor fixes are available. No exact fixed versions were provided in the input, so remediation should be tracked through Microsoft Security Update Guide, Windows cumulative update release notes, and enterprise patch management baselines. Prioritize domain controllers and any server running AD DS. Until patches are deployed, restrict network access to domain controller management and directory service ports to trusted administrative and application segments, enforce least privilege for domain accounts, monitor for anomalous authenticated AD DS traffic, ensure domain controller backups are current, and review membership of privileged groups. Do not expose domain controllers to untrusted networks.

How to confirm the fix worked

Confirm all domain controllers have been inventoried and identified by operating system version. Verify whether each affected Windows Server 2022 or Windows Server 2025 domain controller has received the applicable Microsoft cumulative update once available. Validate using Windows build numbers, installed hotfix records, centralized patch management reports, and vulnerability scanner checks. Confirm AD DS is not reachable from untrusted network segments except where explicitly required. Perform authenticated scans where possible, and review firewall rules, segmentation controls, and domain controller attack surface. After remediation, monitor for LSASS or AD DS instability, unexpected service crashes, anomalous directory changes, and unusual privileged account activity to ensure there are no signs of pre-patch exploitation.

Typical attack path

1. Obtain valid domain credentials through phishing, password reuse, malware, or prior compromise.
2. Identify reachable domain controllers running affected Windows Server 2022 or Windows Server 2025 versions with AD DS enabled.
3. Send crafted authenticated network traffic to AD DS to trigger the stack-based buffer overflow.
4. Achieve arbitrary code execution on the domain controller in the context of the vulnerable service.
5. Establish persistence by modifying directory objects, adding privileged users, or changing group memberships.
6. Collect credentials or replication secrets and use them for lateral movement or domain-wide privilege escalation.
7. Cover tracks by clearing logs, modifying audit settings, or blending malicious activity into normal administrative operations.

How to detect it

To determine whether exploitation may already have occurred, examine domain controller telemetry before and after the disclosure and patch window. Prioritize Windows Security logs, System logs, Application logs, Directory Service logs, DNS Server logs, PowerShell logs, Sysmon or EDR telemetry, crash dumps, and network flow records to domain controllers. Look for abnormal authenticated connections to AD DS shortly before LSASS or directory service crashes, application fault events involving lsass.exe or AD DS components, unexpected child processes spawned by lsass.exe, new or modified privileged users, changes to Domain Admins, Enterprise Admins, Administrators, Account Operators, Backup Operators, or Group Policy permissions, and evidence of credential access or replication abuse. Useful Windows events include process creation events 4688 or Sysmon Event ID 1, logon events 4624 and 4627, privileged group changes 4728, 4732, 4756, account creation 4720, account modification 4738, directory object changes 5136, sensitive directory access 4662, audit policy changes 4719, service installation 7045, service crashes 7031, and application crashes 1000 or 1001. Investigate any LSASS crash followed by rapid privilege escalation, new administrative accounts, remote command execution, or anomalous replication activity.

• Image=*\\lsass.exe AND ParentImage!=*\\wininit.exe
• ParentImage=*\\lsass.exe AND Image=*\\cmd.exe
• ParentImage=*\\lsass.exe AND Image=*\\powershell.exe
• ParentImage=*\\lsass.exe AND Image=*\\pwsh.exe
• ParentImage=*\\lsass.exe AND Image=*\\wscript.exe
• ParentImage=*\\lsass.exe AND Image=*\\cscript.exe
• ParentImage=*\\lsass.exe AND Image=*\\rundll32.exe
• ParentImage=*\\lsass.exe AND Image=*\\regsvr32.exe
• ParentImage=*\\lsass.exe AND Image=*\\mshta.exe
• Faulting application name: lsass.exe
• Event ID 7031 AND Active Directory Domain Services
• Event ID 1000 AND lsass.exe
• Event ID 1001 AND lsass.exe
• Event ID 7045 AND Service File Name
• Event ID 4728 AND Domain Admins
• Event ID 4732 AND Administrators
• Event ID 4756 AND Enterprise Admins
• Event ID 5136 AND groupPolicyContainer
• Event ID 4662 AND DS-Replication-Get-Changes
• Event ID 4662 AND DS-Replication-Get-Changes-All
• Event ID 4688 AND procdump.exe AND lsass.exe
• Event ID 4688 AND rundll32.exe AND comsvcs.dll
• ntds.dit
• C:\\Windows\\NTDS\\ntds.dit
• C:\\Windows\\System32\\lsass.exe

What your security team should do

• Prioritize patching or compensating controls for all domain controllers running affected Windows Server 2022 or Windows Server 2025 versions.
• Use network segmentation to limit access to domain controllers from only approved systems and administrative networks.
• Audit low-privileged and service accounts because exploitation requires valid credentials but not administrator privileges.
• Increase monitoring on domain controllers for LSASS crashes, unexpected child processes, suspicious directory changes, and privileged group modifications.
• Review privileged group membership, domain admin activity, and recent changes to Group Policy Objects and directory permissions.
• Ensure domain controller backups, system state backups, and forest recovery procedures are tested and protected from tampering.
• Enable or tune detections for credential dumping, DCSync-style replication abuse, and unusual LDAP/RPC activity against domain controllers.
• Track Microsoft advisories for exact fixed builds and update deployment status until all affected servers are remediated.