CVE-2026-50682

What it actually does

CVE-2026-50682 is an out-of-bounds read vulnerability in Windows Active Directory reachable over the network by an authenticated, low-privileged attacker. The flaw can cause affected Active Directory components, most importantly domain-controller directory services or related LSASS-hosted functionality, to read memory outside expected bounds. The assessed impact is primarily denial of service, with high availability impact and limited confidentiality impact; there is no indicated integrity impact or remote code execution based on the provided details.

Why it matters to the business

Successful exploitation can disrupt Active Directory availability, which may interrupt authentication, authorization, Group Policy processing, domain-joined system access, application logins, and administrative operations. For organizations dependent on Windows domain services, this can create broad operational outages even without full system compromise. The issue was published 28 days ago, affects current Windows client and server releases including Windows Server 2022 and 2025, and does not currently appear in CISA KEV or have known exploit maturity, but the low attack complexity and network reachability make timely remediation important.

How an attack unfolds

An attacker first obtains any valid domain or local credentials sufficient to interact with the vulnerable Active Directory network-facing functionality. From a network location that can reach the affected service, the attacker sends specially crafted requests that trigger the out-of-bounds read condition. When the vulnerable code processes the malformed input, it may access invalid memory and destabilize the service. On a domain controller, this can result in LSASS or Active Directory Domain Services failure, service restart, degraded domain-controller behavior, or repeated crashes if the attacker continues sending the trigger. The likely attacker objective is service disruption rather than persistence or data modification.

How to fix it

Apply the applicable Microsoft security updates for all affected Windows versions as soon as vendor fixes are available through Windows Update, WSUS, Microsoft Update Catalog, or enterprise patch management. Because exact fixed build numbers were not provided, track the Microsoft advisory for CVE-2026-50682 and verify that Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 systems receive the corresponding cumulative update. Prioritize domain controllers and systems providing Active Directory services. Until patched, reduce exposure by limiting network access to domain controllers and directory services to trusted administrative and client networks, enforcing least privilege for authenticated users, monitoring for abnormal authentication and directory-service traffic, and ensuring domain-controller redundancy so authentication services can tolerate a node outage.

How to confirm the fix worked

Confirm that each affected host has installed the Microsoft cumulative update that includes the fix for CVE-2026-50682, using centralized patch inventory, Windows Update history, PowerShell-based hotfix/build checks, or vulnerability scanning authenticated to the host. Validate that domain controllers are on the expected fixed OS build after reboot. Review Microsoft advisory guidance for any required post-installation steps. From an exposure perspective, verify that only expected networks can reach Active Directory services on domain controllers and that unauthenticated internet access to domain-controller management or directory-service ports is blocked. Where safe and authorized, use a vulnerability scanner with a plugin for this CVE rather than attempting exploit reproduction, because validation by exploitation may crash production directory services.

Typical attack path

1. Acquire or use existing low-privileged valid credentials in a Windows domain or affected environment.
2. Identify reachable domain controllers or systems exposing the vulnerable Active Directory functionality.
3. Send crafted network requests to the affected Active Directory service using the authenticated session.
4. Trigger the out-of-bounds read condition during request processing.
5. Cause service instability, crash, restart, or denial of service affecting authentication and directory operations.
6. Optionally repeat the request to sustain or reintroduce the outage.

How to detect it

To assess whether exploitation may already have occurred, review domain-controller and affected Windows host telemetry for unexplained LSASS or Active Directory Domain Services crashes, service restarts, Windows Error Reporting events, memory dumps, and correlated authenticated network activity. Useful log sources include Windows System logs, Application logs, Directory Service logs, Security logs, Windows Error Reporting, EDR process telemetry, crash dump collections, domain-controller firewall logs, and network flow records to Active Directory service ports. Look for Event Log entries showing lsass.exe application faults, NTDS/Active Directory Domain Services termination, Service Control Manager restarts, or repeated crash/restart cycles. Correlate crash times with Security log authentication events and inbound connections from the same account or host. Because no public exploit string, tool name, or packet signature is provided, detection should focus on behavioral indicators: authenticated access immediately preceding directory-service instability, repeated attempts against multiple domain controllers, and unusual source systems generating high-volume or malformed directory-service traffic.

• lsass.exe
• C:\Windows\System32\lsass.exe
• Faulting application name: lsass.exe
• The Active Directory Domain Services service terminated unexpectedly
• The Directory Services service terminated unexpectedly
• Service Control Manager
• Windows Error Reporting
• AppCrash_lsass.exe
• C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_lsass.exe
• C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_lsass.exe
• NTDS
• Directory Service

What your security team should do

• Prioritize patching domain controllers and Active Directory infrastructure before lower-risk endpoints because exploitation can disrupt authentication across the environment.
• Track Microsoft advisory updates for exact fixed builds and deploy the relevant cumulative updates through standard emergency or accelerated patch processes.
• Review network segmentation so only approved client, server, and administrative networks can reach domain-controller directory-service ports.
• Increase monitoring for LSASS crashes, Active Directory Domain Services restarts, unusual authenticated request spikes, and repeated failures from the same source systems.
• Confirm domain-controller redundancy, replication health, and backup/restore readiness before broad patch deployment.
• Hunt for recent unexplained directory-service outages or LSASS crash artifacts since publication, especially where they coincide with authenticated network activity.
• Do not treat absence from CISA KEV or lack of known exploit maturity as proof of safety; the vulnerability has low attack complexity and can be impactful in domain environments.