CVE-2026-54119

What it actually does

This is a network-reachable denial-of-service flaw in Windows Active Directory caused by a loop with an unreachable exit condition. An unauthenticated remote attacker can send specially crafted network input to an affected Active Directory service path and cause excessive processing or a hang, degrading or interrupting directory service availability. The impact is availability-only: the CVSS vector indicates no confidentiality or integrity impact, but high availability impact, no authentication required, low attack complexity, and no user interaction.

Why it matters to the business

Successful exploitation can make Active Directory services unreliable or unavailable, which can disrupt sign-ins, authentication-dependent applications, Group Policy processing, domain joins, administrative operations, and service account authentication. Because Active Directory is often a critical dependency for Windows-based business operations, even a pure denial-of-service issue can create broad operational outages. The current exploitation signal is relatively low: it is not listed in CISA KEV, is not marked as ransomware-associated, has low EPSS, and no public exploit maturity is reported; however, the vulnerability is remotely reachable and unauthenticated, so exposed or poorly segmented domain controllers should still be prioritized.

How an attack unfolds

An attacker first identifies reachable Windows systems providing Active Directory-related services, most importantly domain controllers. The attacker then sends crafted unauthenticated network traffic to the vulnerable service interface. Due to the flawed loop condition, the target can enter a non-terminating or resource-consuming execution path. As the affected service consumes CPU, threads, or becomes unresponsive, authentication and directory operations begin timing out. Repeated attempts or distributed traffic can prolong the outage until the vulnerable service is restarted, the host recovers, network access is blocked, or the system is patched.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-54119 to all affected Windows and Windows Server versions, prioritizing domain controllers and systems running Active Directory services. No exact fixed build numbers were provided in the input, so use the applicable Microsoft cumulative/security update for the affected platform release and verify that the July 2026 or later security update containing this fix is installed. Prioritize Windows Server 2012, 2016, 2019, 2022, and 2025 domain controllers, then affected Windows 10 and Windows 11 systems where relevant. If immediate patching is not possible, restrict network access to Active Directory service ports to trusted systems only, enforce segmentation around domain controllers, block direct internet exposure, monitor for abnormal unauthenticated traffic, and prepare operational runbooks for controlled service restart or domain controller failover.

How to confirm the fix worked

Confirm that each affected system has the relevant Microsoft security update installed using Windows Update, WSUS, Microsoft Update Catalog metadata, endpoint management inventory, or PowerShell-based hotfix/update reporting. Validate that all domain controllers report consistent patch levels and have successfully rebooted where required. From a network perspective, verify that Active Directory service ports are not exposed to untrusted networks and that firewall rules limit access to authorized clients and management networks. Operationally, confirm that LDAP, Kerberos, Netlogon, DNS, replication, and domain sign-in tests succeed after patching. If vulnerability scanning is used, rescan authenticated Windows assets and verify the scanner no longer reports the affected Windows builds as vulnerable.

Typical attack path

1. Identify an exposed or reachable Windows Active Directory service, typically on a domain controller.
2. Confirm that directory service ports are reachable over the network, such as LDAP, LDAPS, Kerberos, SMB, RPC, or related Active Directory service endpoints.
3. Send malformed or specially crafted unauthenticated requests that trigger the vulnerable infinite-loop condition.
4. Cause the Active Directory service process or dependent authentication services to hang, spike CPU, exhaust worker threads, or become unavailable.
5. Repeat or sustain requests to keep the directory service degraded and disrupt authentication-dependent business services.

How to detect it

To determine whether this flaw may have already been exploited, review domain controller and Windows server telemetry for sudden authentication outages, directory service unresponsiveness, abnormal CPU saturation, and repeated unauthenticated connection bursts to Active Directory-related ports. Useful log sources include Windows System logs, Application logs, Directory Service logs, Security logs, DNS Server logs, Kerberos and Netlogon operational logs, EDR process telemetry, firewall logs, VPN logs, load balancer logs, and network flow records. Look for time-correlated spikes in LDAP, LDAPS, Kerberos, SMB, RPC, or Netlogon traffic from one or more unauthenticated or unusual source addresses, followed by LSASS or directory service hangs, service restarts, domain controller health-check failures, replication failures, or widespread authentication errors. Because no public exploit pattern or unique payload indicator is provided, detection should focus on behavioral evidence: high-volume or malformed directory-service traffic, domain controller resource exhaustion, and availability failures occurring without a normal administrative cause.

• lsass.exe
• NTDS
• Active Directory Domain Services
• Directory Service
• Netlogon
• Kerberos-Key-Distribution-Center
• Event ID 1000
• Event ID 1001
• Event ID 1015
• Event ID 1126
• Event ID 1311
• Event ID 1566
• Event ID 1865
• Event ID 2887
• Event ID 2888
• Event ID 2889
• Event ID 5719
• Event ID 5722
• Event ID 5805
• Event ID 6008
• Event ID 7031
• Event ID 7034
• Event ID 7040
• TCP/389
• TCP/636
• TCP/3268
• TCP/3269
• TCP/88
• UDP/88
• TCP/445
• TCP/135

What your security team should do

• Prioritize patching domain controllers and other Active Directory infrastructure before general-purpose workstations because outage impact is highest there.
• Inventory all affected Windows Server and Windows client versions listed as in scope, and confirm whether they are running Active Directory or domain-controller roles.
• Restrict access to Active Directory service ports from untrusted networks and remove any direct internet exposure to domain controllers.
• Increase monitoring for domain controller CPU saturation, LSASS or directory service hangs, authentication failures, LDAP/Kerberos timeouts, and unexpected service restarts.
• Review firewall, VPN, and segmentation controls to ensure only approved networks can reach domain controller service interfaces.
• Prepare incident response procedures for Active Directory denial-of-service events, including traffic blocking, domain controller isolation, failover, and safe reboot procedures.
• Track Microsoft advisory updates for exact fixed build numbers and any change in exploit maturity, EPSS trend, or KEV status.