CVE-2026-57976

What it actually does

CVE-2026-57976 is a network-reachable denial-of-service vulnerability in Microsoft Active Directory Domain Services caused by a null pointer dereference. An attacker who already has valid low-privileged domain credentials can send crafted network traffic to AD DS and trigger a crash condition. Because AD DS runs on domain controllers and is tightly coupled with LSASS and directory services, successful exploitation can make authentication, directory lookup, Group Policy processing, Kerberos, LDAP, and other domain-dependent functions unavailable until the affected service or server recovers or is restarted. The vulnerability does not provide code execution, data theft, or privilege escalation based on the published description, but it has high availability impact.

Why it matters to the business

Successful exploitation can disrupt identity infrastructure and prevent users, servers, and applications from authenticating or resolving directory information. In practical terms, this can cause login failures, application outages, failed administrative operations, Group Policy delays, and broader business disruption if domain controllers become unstable or unavailable. The CVSS score is moderate-to-high for availability impact, but current EPSS is low and the vulnerability is not listed in CISA KEV, so there is no public signal of broad exploitation at this time. However, because Active Directory is foundational infrastructure and exploitation only requires a valid account plus network access, patching should be prioritized for domain controllers and other systems running AD DS.

How an attack unfolds

An attacker first obtains or uses existing valid domain credentials, such as a compromised low-privileged user account. From a system with network reachability to a domain controller, the attacker interacts with Active Directory Domain Services over supported directory service protocols and sends a crafted request sequence that exercises the vulnerable code path. The malformed or unexpected request state causes AD DS to dereference a null pointer, resulting in a crash or service disruption. If the affected process or service fails in a way that impacts LSASS or core directory services, the domain controller may stop servicing authentication and directory requests, and in some cases may require service recovery or a reboot. Repeated exploitation could be used to keep one or more domain controllers unavailable, increasing the operational impact across the domain.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-57976 to all affected Windows client and server versions, with highest priority on domain controllers and systems providing Active Directory Domain Services. Affected platforms include Windows Server 2012, 2016, 2019, 2022, and 2025, as well as listed Windows 10 and Windows 11 versions. No exact fixed build numbers were provided in the input, so use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or the Microsoft Update Catalog to install the applicable cumulative security update for the affected operating system release. If immediate patching is not possible, reduce exposure by restricting network access to domain controllers to only required systems and administration networks, blocking unnecessary LDAP/LDAPS/Kerberos/RPC exposure from untrusted segments, disabling or removing unused accounts, enforcing strong authentication controls, and monitoring for repeated directory service crashes or anomalous authenticated directory traffic. Ensure multiple domain controllers remain available and healthy to reduce single-point-of-failure risk during remediation.

How to confirm the fix worked

Confirm that all domain controllers and affected Windows systems have installed the relevant Microsoft security update or a later cumulative update. Validate patch deployment through Windows Update history, enterprise patch management reporting, and system build or hotfix inventory. After patching, reboot systems if required and verify that Active Directory Domain Services, Kerberos, LDAP/LDAPS, DNS integration, SYSVOL replication, and Group Policy processing are functioning normally. Review System, Application, Directory Service, and Windows Error Reporting logs for recurring lsass.exe, ntdsai.dll, or Active Directory Domain Services crash events after patching. Where safe and authorized, vulnerability validation should rely on authenticated version/build checks rather than exploit attempts, because reproducing the flaw may intentionally disrupt domain controller availability.

Typical attack path

1. Acquire valid low-privileged domain credentials through phishing, credential theft, password spraying, reuse, or insider access.
2. Identify reachable domain controllers and AD DS-exposed services from the network.
3. Establish authenticated network communication with Active Directory Domain Services.
4. Send crafted AD DS request traffic that triggers the null pointer dereference condition.
5. Cause the affected directory service component or domain controller process to crash or become unstable.
6. Optionally repeat the request against one or more domain controllers to prolong authentication and directory-service outages.

How to detect it

To determine whether exploitation may have already occurred, review domain controller logs for unexplained crashes or restarts of Active Directory Domain Services, LSASS, or related directory service components. Useful log sources include Windows System logs, Application logs, Directory Service logs, Windows Error Reporting events, security authentication logs, domain controller health monitoring, EDR process telemetry, and network telemetry for LDAP, LDAPS, Kerberos, SMB, and RPC connections to domain controllers. Look for Application Error or Windows Error Reporting entries involving lsass.exe, ntdsai.dll, ntds.dit-related components, or Active Directory Domain Services around the time of authentication outages. Correlate crashes with authenticated connections from the same user account, workstation, source IP, or service account shortly before the outage. Also investigate repeated domain controller reboots, service-control recovery actions, sudden spikes in failed authentication, LDAP errors, Kerberos failures, replication failures, or client reports of domain unavailability. Because public exploit details and unique payload indicators are not available from the provided information, detection should focus on crash artifacts, repeated availability failures, and suspicious authenticated directory-service access patterns rather than a single definitive signature.

• lsass.exe
• ntdsai.dll
• Active Directory Domain Services
• Application Error
• Windows Error Reporting
• Faulting application name: lsass.exe
• Faulting module name: ntdsai.dll
• The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly
• C:\Windows\System32\lsass.exe
• C:\Windows\NTDS\ntds.dit
• Event ID 1000
• Event ID 1001
• Event ID 1015
• Event ID 1074
• Event ID 6008
• Event ID 7031
• Directory Service log
• System log
• Application log
• LDAP server is unavailable
• The specified domain either does not exist or could not be contacted

What your security team should do

• Prioritize patching domain controllers and AD DS-hosting servers before lower-risk endpoints because the primary impact is directory and authentication availability.
• Inventory all affected Windows Server and Windows client versions and confirm which systems provide Active Directory Domain Services.
• Use enterprise patch tooling to deploy the applicable Microsoft cumulative security update and verify successful installation across all domain controllers.
• Restrict access to domain controller management and directory service ports from nonessential networks, especially user workstations and untrusted segments.
• Monitor for repeated AD DS, LSASS, or domain controller service crashes, particularly following authenticated LDAP, LDAPS, Kerberos, or RPC activity.
• Review recently created, dormant, or low-privileged domain accounts for suspicious use, since exploitation requires an authorized attacker.
• Ensure domain controller redundancy, replication health, and backup/restore procedures are current before and after patch deployment.
• Treat any unexplained domain controller crash loop or repeated authentication outage as a potential security incident until logs and crash artifacts are reviewed.