CVE-2026-49178

What it actually does

CVE-2026-49178 is a heap-based buffer overflow in Active Directory Domain Services that can be triggered remotely over the network by an authenticated attacker. Because Active Directory Domain Services runs as a highly privileged Windows service on domain controllers, successful exploitation could allow arbitrary code execution in a privileged context, potentially leading to full compromise of the domain controller. The CVSS vector indicates network reachability, low attack complexity, no user interaction, and low privileges required, with high confidentiality, integrity, and availability impact.

Why it matters to the business

A successful attack against a domain controller can compromise the central identity system used to authenticate users, servers, and applications. This could allow an attacker to take over privileged accounts, disrupt authentication, deploy malware broadly, access sensitive data, or undermine trust across the Windows domain. Although this issue is not currently listed in CISA KEV and no mature public exploit is indicated, the high severity and Active Directory impact make timely patching important, especially for internet-exposed or broadly reachable domain controller services.

How an attack unfolds

An attacker first obtains valid low-privileged domain credentials or compromises an account that can communicate with Active Directory Domain Services. The attacker then sends specially crafted network traffic to a vulnerable domain controller over an AD-related protocol path. The malformed input triggers a heap-based memory corruption condition inside the AD DS service process. If exploitation is reliable, the attacker can redirect execution flow and run attacker-controlled code with the privileges of the affected service. From there, the attacker may dump credentials, create or modify privileged accounts, alter directory objects, disable security controls, or use the domain controller as a launch point for broader lateral movement. Failed exploitation attempts may result in service instability, LSASS crashes, domain controller reboots, authentication failures, or Windows Error Reporting events.

How to fix it

Apply the Microsoft security updates that address this vulnerability for all affected Windows client and server versions, prioritizing domain controllers and systems with Active Directory Domain Services roles. Where exact fixed build numbers are not available, use the latest cumulative security update from Microsoft for the affected Windows release. Prioritize Windows Server 2012, 2016, 2019, 2022, and 2025 domain controllers, followed by supported Windows client systems that may include AD DS components or management services. If immediate patching is not possible, reduce exposure by restricting network access to domain controllers to required administrative and member-system subnets, blocking unnecessary inbound access to LDAP/LDAPS/Kerberos/RPC/SMB from untrusted networks, enforcing least privilege for domain accounts, monitoring for abnormal authentication and directory modification activity, and ensuring domain controllers are protected by endpoint detection and response tooling. These mitigations reduce risk but should not be treated as a substitute for vendor patches.

How to confirm the fix worked

Confirm that all affected Windows systems, especially domain controllers, have installed the relevant Microsoft cumulative security update released to remediate this issue or a later superseding update. Validate patch status using Windows Update, WSUS, Microsoft Configuration Manager, Intune, vulnerability scanning, or PowerShell inventory of installed hotfixes and OS build numbers. Re-run authenticated vulnerability scans against domain controllers after patching. Confirm that vulnerable hosts no longer appear in scanner results for this CVE. Review firewall and segmentation policy to ensure AD-related ports are reachable only from expected networks. Monitor for post-patch service stability and verify that domain authentication, replication, Kerberos, LDAP, and Group Policy operations remain healthy.

Typical attack path

1. Acquire or steal valid low-privileged domain credentials.
2. Identify reachable domain controllers and exposed AD-related services such as LDAP, LDAPS, Kerberos, SMB, or RPC endpoints.
3. Send crafted network requests designed to trigger the heap-based buffer overflow in Active Directory Domain Services.
4. Achieve code execution in the context of the vulnerable AD DS process if exploitation succeeds.
5. Establish persistence or execute follow-on tooling on the domain controller.
6. Dump credentials, extract directory secrets, modify privileged groups, or create new privileged accounts.
7. Use domain-level access for lateral movement, data theft, ransomware deployment, or operational disruption.

How to detect it

Investigate whether vulnerable domain controllers experienced unexplained LSASS crashes, AD DS service instability, authentication outages, or abnormal network traffic before remediation. Useful log sources include Windows Security logs, System logs, Directory Service logs, DNS Server logs, Kerberos Key Distribution Center logs, Windows Error Reporting logs, EDR telemetry, firewall logs, NetFlow, and packet captures for domain controller traffic. Look for repeated inbound connections to AD-related services from unusual workstations, service accounts, VPN ranges, or non-administrative hosts. Review Event ID 4624 for unusual successful logons, 4625 for failed logons, 4768/4769/4771 for Kerberos anomalies, 4776 for NTLM authentication anomalies, 4672 for special privilege assignment, 4720 for account creation, 4728/4732/4756 for privileged group membership changes, 4738 for account modification, 1102 for log clearing, and Directory Service events indicating replication, database, or service errors. On hosts, look for LSASS access by unusual processes, credential dumping indicators, unexpected child processes from privileged Windows services, suspicious binaries written to domain controllers, and unexpected changes to privileged directory objects. Because no public exploit artifacts are provided, detection should focus on behavioral evidence: service crashes, memory-corruption symptoms, suspicious authenticated traffic to AD services, and post-exploitation activity on domain controllers.

• lsass.exe
• Faulting application name: lsass.exe
• Exception code: 0xc0000005
• Windows Error Reporting
• Event ID 1000
• Event ID 1001
• Event ID 4624
• Event ID 4625
• Event ID 4672
• Event ID 4720
• Event ID 4728
• Event ID 4732
• Event ID 4738
• Event ID 4756
• Event ID 4768
• Event ID 4769
• Event ID 4771
• Event ID 4776
• Event ID 1102
• Directory Service
• Active Directory Domain Services
• NTDS
• KDC
• LDAP
• LDAPS
• TCP/389
• TCP/636
• TCP/3268
• TCP/3269
• TCP/88
• TCP/135
• TCP/445

What your security team should do

• Patch all domain controllers and AD DS servers first, then complete remediation across remaining affected Windows systems.
• Treat domain controllers as highest-priority assets because successful exploitation could lead to domain-wide compromise.
• Audit exposure of LDAP, LDAPS, Kerberos, RPC, SMB, and Global Catalog services and restrict access to trusted networks only.
• Hunt for recent LSASS or AD DS crashes, Windows Error Reporting events, unusual inbound traffic to domain controllers, and suspicious privileged directory changes since publication.
• Review low-privileged account activity for abnormal authentication patterns to domain controllers, especially from unusual hosts or service accounts.
• Increase monitoring for creation of new privileged users, additions to Domain Admins or equivalent groups, replication abuse, and credential-dumping activity.
• Ensure reliable backups and tested recovery procedures for domain controllers and Active Directory system state.
• Because the issue is not currently KEV-listed and EPSS is low, prioritize based on asset criticality rather than public exploitation alone; domain controllers should still be remediated urgently.