CVE-2026-50366

What it actually does

CVE-2026-50366 is a network-reachable denial-of-service vulnerability in Active Directory Domain Services caused by a null pointer dereference. An authenticated attacker with low privileges can send a crafted request to the affected AD DS service and trigger a crash condition, impacting availability of directory services. Confidentiality and integrity are not indicated as directly affected, but AD DS availability loss can disrupt authentication, authorization, domain controller operations, Group Policy processing, and dependent enterprise services.

Why it matters to the business

Successful exploitation can make affected domain services unavailable, which may prevent users, servers, and applications from authenticating or accessing domain resources. In practical terms, this can cause login failures, application outages, delayed administrative operations, and degraded business continuity. The issue is not currently listed in CISA KEV, is not known to be ransomware-associated, has low EPSS, and has no reported exploit maturity, but it has a high availability impact and affects widely deployed Windows Server and Windows client versions, so patching should still be prioritized for domain controllers and other systems running AD DS roles.

How an attack unfolds

An attacker first obtains valid low-privileged domain credentials or uses an already-compromised account. From a network location that can reach an affected Active Directory Domain Services endpoint, the attacker sends a malformed or unexpected AD DS request that reaches the vulnerable code path. The service mishandles the input and dereferences a null pointer, causing the AD DS process or associated LSASS-hosted directory service components to crash. On a domain controller, this can interrupt authentication and directory operations until the service recovers, the host restarts, or failover to another domain controller occurs. Repeated requests could sustain disruption across one or more reachable domain controllers.

How to fix it

Apply the applicable Microsoft security update for CVE-2026-50366 or a later cumulative update on all affected Windows versions, especially domain controllers and systems running Active Directory Domain Services. No exact fixed build or KB was provided in the input, so use Microsoft Update, WSUS, Microsoft Update Catalog, or enterprise patch tooling to deploy the vendor-provided update for the affected operating system release. Prioritize Windows Server 2012, 2016, 2019, 2022, and 2025 domain controllers, followed by affected Windows client systems where relevant. If immediate patching is not possible, reduce exposure by limiting network access to domain controllers to required management and domain service networks, blocking untrusted network paths to AD DS protocols where feasible, enforcing strong account hygiene to reduce abuse of low-privileged credentials, monitoring for repeated directory-service crashes, and ensuring sufficient domain controller redundancy.

How to confirm the fix worked

Confirm that each affected system has installed the Microsoft cumulative/security update that includes the fix for CVE-2026-50366. Validate through Windows Update history, enterprise patch compliance reports, PowerShell hotfix/update inventory, or Microsoft Defender Vulnerability Management where available. Confirm that domain controllers remain healthy after patching by checking replication status, domain controller service health, authentication success rates, and absence of new LSASS or AD DS crash events. Exposure can be validated by inventorying systems running affected Windows versions and identifying hosts with Active Directory Domain Services roles enabled; avoid attempting to reproduce the crash in production.

Typical attack path

1. Acquire valid domain credentials or compromise a low-privileged account.
2. Identify reachable domain controllers or systems exposing Active Directory Domain Services over the network.
3. Send a crafted AD DS request that triggers the null pointer dereference.
4. Cause the affected AD DS component, commonly hosted within LSASS on domain controllers, to crash or become unavailable.
5. Repeat the request against the same or additional domain controllers to prolong authentication and directory-service disruption.

How to detect it

To determine whether exploitation may already have occurred, review Windows Event Logs on domain controllers and AD DS servers for LSASS crashes, AD DS service terminations, unexpected reboots, and clustered timing of authentication failures. Key log sources include System, Application, Directory Service, Security, Windows Error Reporting, Microsoft-Windows-LSA, and Microsoft-Windows-ActiveDirectory_DomainService operational logs where enabled. Look for Event ID 1000 or 1001 involving lsass.exe or AD DS-related modules, Service Control Manager Event IDs 7031 or 7034 showing unexpected service termination, Event ID 6008 or Kernel-Power 41 indicating unplanned restart after service failure, and bursts of Kerberos/NTLM/LDAP errors around the same time. Correlate crash timestamps with network telemetry showing inbound LDAP, LDAPS, Kerberos, Global Catalog, RPC, or SMB activity from the same source shortly before the crash. Because this is a denial-of-service condition, artifacts may be limited to crash dumps, Windows Error Reporting records, service restart events, and abnormal authentication failures rather than persistent files or malware. If crash dumps are retained, preserve LSASS or WER dump metadata for vendor or forensic review and check whether the faulting process/module aligns with AD DS components.

• Faulting application name: lsass.exe
• Faulting process name: lsass.exe
• Faulting module name: ntdsai.dll
• Active Directory Domain Services service terminated unexpectedly
• The Active Directory Domain Services service terminated unexpectedly
• The Active Directory Domain Services service terminated with the following service-specific error
• Event ID 1000
• Event ID 1001
• Event ID 7031
• Event ID 7034
• Event ID 6008
• Kernel-Power
• Windows Error Reporting
• WERFault.exe
• C:\Windows\System32\lsass.exe
• C:\Windows\System32\ntdsai.dll
• C:\ProgramData\Microsoft\Windows\WER\ReportArchive
• C:\ProgramData\Microsoft\Windows\WER\ReportQueue
• lsass.exe.mdmp
• NTDS General
• LDAP Interface Events

What your security team should do

• Prioritize patch deployment on all domain controllers and AD DS servers because the vulnerability directly affects authentication infrastructure availability.
• Inventory affected Windows Server and Windows client versions, with special attention to Windows Server 2012, 2016, 2019, 2022, and 2025 systems running AD DS roles.
• Review network segmentation so only required systems can reach domain controller service ports, including LDAP, LDAPS, Kerberos, Global Catalog, RPC endpoint mapper, and dynamic RPC ranges.
• Hunt for unexplained LSASS, AD DS, or domain controller service crashes since publication, especially repeated events from the same source network or account context.
• Monitor for unusual authentication or directory-service request patterns from low-privileged accounts, newly created accounts, disabled-but-reenabled accounts, or accounts authenticating from atypical hosts.
• Verify domain controller redundancy, replication health, backup readiness, and recovery runbooks to reduce operational impact if exploitation causes service instability.
• Track Microsoft advisories for fixed build numbers or KB-specific guidance and update patch baselines accordingly.