Type confusion (CWE-843) in Windows DHCP Server enables unauthenticated remote denial of service across an extensive range of Windows Server releases, from Windows Server 2012 through Windows Server 2025. An attacker on the network can send a malformed DHCP packet that triggers incompatible type access in the DHCP service, crashing it and disrupting IP address assignment for all network clients served by that host. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a straightforward network-reachable DoS.
Out-of-bounds read in Windows DHCP Server (CWE-125) allows unauthenticated remote attackers to crash the DHCP service, denying IP address assignment to all clients on affected subnets. The vulnerability spans a wide range of Windows Server versions from 2012 through 2025, as well as Windows 10 builds with the DHCP Server role enabled. Microsoft has released patched builds; no public exploit code or CISA KEV listing has been identified at time of analysis, but the AV:N/PR:N attack surface on a critical network infrastructure service warrants prompt patching.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service enables an unauthenticated remote attacker to crash the service by sending a crafted network packet, resulting in denial of DHCP service to all network clients. All actively supported Windows Server releases from 2012 through 2025 are affected, as is Windows 10 versions 1607 and 1809 with the DHCP Server role installed. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated remote denial-of-service in the Windows DHCP Server role allows network-accessible attackers to crash the DHCP service by sending malformed packets that trigger an out-of-bounds read (CWE-125). Affected versions span Windows Server 2012 through Windows Server 2025, all requiring the DHCP Server role to be installed and running. Microsoft has released patches for all supported versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Denial-of-service via out-of-bounds read in Windows DHCP Server allows a remote, unauthenticated attacker to crash the DHCP service across a broad range of Windows Server versions. Exploitation requires only network access and no authentication, making it trivially reachable by any host on a network segment served by the vulnerable DHCP role. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity network vector and wide affected version range make this a credible operational risk for enterprise environments.
Out-of-bounds read in the Windows DHCP Server role exposes all supported Windows Server versions - from Server 2012 through Server 2025 - to unauthenticated network-based denial of service. An attacker on the network can send a specially crafted DHCP packet that triggers the CWE-125 read violation, crashing or hanging the DHCP service and severing lease renewal for all network clients served by that instance. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Unauthenticated network information disclosure in the Windows Services for NFS ONCRPC XDR Driver allows a remote attacker to obtain sensitive system information without any credentials or user interaction. The vulnerability, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), affects a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature releases. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS AV:N/AC:L/PR:N/UI:N profile indicates straightforward network exploitability wherever the NFS feature is enabled.
Information disclosure in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to unauthenticated network attackers across a vast range of Windows Server and client editions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is improper null termination (CWE-170), a memory safety defect where string buffers are read beyond their intended boundary, leaking adjacent memory to a remote caller before any authentication handshake completes. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and breadth of affected systems make this a high-priority patch for any organization with RDP exposed.
Security feature bypass in the Windows TCP/IP stack allows unauthenticated remote attackers to circumvent network-level security controls across a broad range of Windows client and server versions, from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025. Exploitation leverages CWE-1288 (improper consistency validation within input), meaning crafted packets with internally contradictory fields can slip past enforcement mechanisms - resulting in high integrity impact with no confidentiality or availability effect. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version families.
Out-of-bounds read in the Windows DHCP Server component allows unauthenticated network attackers to disclose potentially sensitive server memory contents by sending a specially crafted DHCP packet. The flaw spans a broad range of Windows releases from Server 2012 through Server 2025 and certain Windows 10 builds, with Microsoft-confirmed patches available and exact fix build numbers documented by ENISA EUVD-2026-73249. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.77% (53rd percentile) reflects low current exploitation probability despite the trivially low attack complexity.
Out-of-bounds read in the Windows DHCP Server service exposes server memory contents to unauthenticated remote attackers via crafted DHCP packets. Confirmed via EUVD/MSRC data, the flaw spans Windows Server 2012 through 2025 across both full and Server Core installations, as well as select Windows 10 versions running the DHCP Server role. Microsoft has released patched builds; no public exploit code or CISA KEV listing exists at time of analysis, keeping near-term exploitation risk moderate.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service exposes server memory to unauthenticated remote attackers across Windows Server 2012 through 2025 and select Windows 10 builds. A crafted DHCP request packet triggers a read beyond the allocated buffer in the server's packet-processing code, leaking potentially sensitive memory contents with no integrity or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS of 0.77% (53rd percentile) reflects below-median exploitation probability despite the zero-authentication network vector.
Out-of-bounds memory read in the Windows DHCP Server service exposes potentially sensitive server memory to unauthenticated remote attackers who send specially crafted DHCP packets. The flaw (CWE-125) spans Microsoft Windows Server 2012 through 2025 and select Windows 10 builds where the DHCP Server role is installed, with Microsoft assigning CVSS 7.5 reflecting full network accessibility and zero authentication requirement. No active exploitation or public proof-of-concept has been identified; EPSS sits at 0.77% (53rd percentile) and a vendor-supplied patch is available.
Incorrect authorization in MongoDB Server's LDAP integration allows an authenticated user to acquire elevated privileges by exploiting stale identity retention in pooled LDAP connections. When LDAP-based authorization is configured and connection pooling is active, a reused connection may carry a prior user's LDAP identity into subsequent authorization queries, causing MongoDB to assign roles intended for a different directory principal. The result is unintended privilege escalation - a lower-privileged user may gain read or write access to data or administrative functions scoped to a higher-privileged LDAP group. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis.
Server-side request forgery in Microsoft Skype for Business Server exposes internal network resources to unauthenticated remote attackers. Three server product lines are affected - Subscription Edition, 2015 (CU13), and 2019 (CU8) - all running builds below their respective patched versions. An attacker with network access to the server can forge requests through the server to enumerate or exfiltrate data from internal systems, with no public exploit identified at time of analysis.
Remote code execution is possible in Windows Remote Desktop Services via a use-after-free memory corruption flaw, affecting Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025. An authenticated, network-connected attacker exploiting this flaw can achieve full compromise of confidentiality, integrity, and availability on the target system. CVSS 7.5 (AV:N/AC:H/PR:L) reflects that exploitation requires low-privilege authentication and high attack complexity, making opportunistic mass exploitation less likely; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Remote Desktop Services (RDS) enables low-privilege authenticated network attackers to achieve remote code execution across a broad range of Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires an authenticated session and elevated exploitation complexity, yielding a base score of 7.5. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available covering 19 distinct OS build lines.
Arbitrary file system read in Adobe ColdFusion 2023 (Update ≤23) and ColdFusion 2025 (Update ≤12) exposes sensitive files and directories outside the intended access scope to unauthenticated remote attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable exploitation requiring no credentials and no user interaction, with high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity raises concern for rapid weaponization.
Unauthenticated network denial-of-service in Microsoft Skype for Business Server allows a remote attacker to crash the service by triggering an integer underflow (CWE-191) in network-facing processing code. Affected are Skype for Business Server 2015, 2019, and the Subscription Edition across specific cumulative update baselines. SSVC marks the vulnerability automatable with exploitation status none at time of analysis, and no public exploit code has been identified.
Out-of-bounds read in the Windows Key Distribution Center (KDC) allows unauthenticated network attackers to crash the Kerberos authentication service by sending a specially crafted packet to port 88, resulting in a denial of service condition. The vulnerability spans the entire supported Windows Server portfolio from Server 2012 through Server 2025, as well as Windows 10 and 11 client builds, confirmed by EUVD-2026-73363. No public exploit code has been identified at time of analysis; however, the unauthenticated, low-complexity network attack surface makes this a high-priority patch for organizations running Active Directory, where KDC availability is a single point of failure for domain-wide Kerberos authentication.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows a network-reachable low-privileged attacker to execute arbitrary code on affected Windows systems, achieving full confidentiality, integrity, and availability compromise. The vulnerability spans an exceptionally broad range of Microsoft Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, as confirmed by EUVD-2026-73631. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, though Microsoft has released corrective security updates across all affected platforms.
Cryptographic signature verification failure in the Remote Desktop client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) exposes session or authentication material to network-based interception. The 'Jwt Attack' technique tag combined with CWE-347 indicates the client insufficiently validates JWT signatures used in modern RDP authentication flows - likely those tied to Azure AD/Entra ID single-sign-on - permitting an attacker to intercept or substitute cryptographic tokens. No active exploitation confirmed at time of analysis, but the unauthenticated network vector and high confidentiality impact make this a meaningful priority for organizations relying on the standalone desktop client for cloud or VDI connectivity.
Use-after-free in the Windows DNS Server component on Windows Server 2025 enables an authorized network attacker to achieve remote code execution with full confidentiality, integrity, and availability impact. The vulnerability carries a CVSS 7.5 rating with high attack complexity (AC:H) and low privilege requirements (PR:L), matching Microsoft's framing of an 'authorized attacker,' which constrains opportunistic exploitation. No public exploit code or CISA KEV listing is present at time of analysis; a vendor patch has been released addressing build 10.0.26100.33438.
Heap-based buffer overflow in the Windows IKE (Internet Key Exchange) Extension allows an authorized network-adjacent attacker to achieve remote code execution across a wide range of Windows client and server releases. The vulnerability (CWE-122) resides in the IKE/IPsec negotiation subsystem and requires low-privilege access to trigger, placing the full C:H/I:H/A:H impact triad within reach of authenticated network peers. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected builds.
Remote code execution in Windows Remote Desktop Services (RDS) allows a low-privileged authenticated network attacker to execute arbitrary code by exploiting a use-after-free condition (CWE-416) in the RDS processing stack. The flaw spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature-update releases - making patch coverage operationally demanding for large Windows estates. No CISA KEV listing and no public exploit code have been identified at time of analysis; however, RDP-facing vulnerabilities historically attract rapid weaponization after disclosure.
Remote code execution in Microsoft SharePoint Server Subscription Edition is possible via a time-of-check time-of-use (TOCTOU) race condition exploitable by authenticated network attackers. The vulnerability, tracked as CWE-367, allows an attacker with at minimum standard SharePoint user credentials to trigger a race window during a file or resource state check, ultimately executing arbitrary code on the server. The CVSS vector (AV:N/AC:H/PR:L) reflects that exploitation requires winning a timing race, raising the bar above trivially automated attacks, but the full C:H/I:H/A:H impact means successful exploitation yields complete server compromise. No public exploit code or active exploitation has been identified at time of analysis.
Incorrect Authorization in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B allows remote unauthenticated attackers to bypass access controls and read sensitive platform data, achieving a privilege-escalation effect without any user interaction. The flaw stems from CWE-863 (Incorrect Authorization), where authorization checks fail to enforce the correct permission boundaries, letting an unauthenticated network request access resources restricted to higher-privilege roles. No public exploit code has been identified at time of analysis, but the combination of PR:N and C:H on a major e-commerce platform makes this a meaningful exposure for confidential business and customer data.
Heap-based buffer overflow (CWE-122) in multiple Microsoft Office versions enables remote code execution when a victim opens a specially crafted document. The CVSS vector (AV:N/AC:H/PR:N/UI:R) confirms network-based delivery without attacker authentication, but exploitation requires high attack complexity and active user interaction - consistent with a maliciously crafted Office file that triggers a memory corruption condition in Office's document parsing subsystem. Affected builds span Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Mac-platform variants; patched build numbers are available for Windows-based SKUs per EUVD-2026-73290, while Mac SKU fix versions are not specified in available data.
Privilege escalation in TYPO3 CMS 14.2.0-14.3.6 allows backend administrators without system-maintainer privileges to schedule configuration commands (configuration:set, configuration:show, configuration:read) through the TYPO3 scheduler module, bypassing the role-based authorization that normally restricts these operations to the highest privilege tier. An attacker holding a backend administrator account can leverage this to silently elevate themselves to system-maintainer status or corrupt system configuration to trigger a denial of service. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Heap-based buffer overflow in the A2DP SBC audio decoder of Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an attacker within Bluetooth range to crash the device by sending a specially crafted L2CAP packet, triggering a denial-of-service condition. The vulnerable component, a2dp_decoder_sbc.cpp, fails to validate input length before copying data onto the heap, resulting in memory corruption. No public exploit code has been confirmed beyond a source-code reference, and no active exploitation has been reported (CISA KEV absent), though the attack is rated automatable by CISA SSVC.
Unauthenticated payment credential hijacking in the Event Tickets and Registration WordPress plugin (StellarWP, all versions ≤5.27.4) allows any remote attacker to silently replace the site's Stripe merchant account credentials - access tokens, publishable keys, and account ID - via a missing capability check on the plugin's Stripe OAuth return endpoint. Once the attacker's own Stripe credentials are stored, all subsequent ticket purchases by legitimate customers are processed into the attacker's account with no visible indication to the buyer or site administrator. No public exploit has been identified at time of analysis, but the fully unauthenticated AV:N/AC:L/PR:N attack surface makes opportunistic mass exploitation straightforward.
Heap-based buffer overflow in the Windows Graphics Kernel subsystem allows a locally authenticated, high-privileged attacker to execute arbitrary code with scope change to kernel context. The vulnerability affects a wide swath of Windows 10, Windows 11, and Windows Server releases from build 1809 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Use-after-free (CWE-416) in the Windows Virtual Trusted Platform Module enables a locally authenticated, high-privileged attacker to escalate privileges across a security boundary on affected Windows 10, 11, and Server editions. The CVSS scope-change metric (S:C) confirms exploitation breaks out of the vTPM trust boundary, yielding complete confidentiality, integrity, and availability impact on the broader host. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as 'none' and automatable as 'no.'
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver enables a local attacker already holding administrator-level privileges to execute arbitrary code with scope change - meaning successful exploitation can affect components beyond the vulnerable driver itself, most critically the Hyper-V hypervisor or co-hosted VMs. The flaw spans virtually all supported Windows versions from Server 2012 through Windows 11 26H1 and Server 2025. Vendor-released patches are available via Microsoft MSRC; no public exploit identified at time of analysis.
SQL injection in AppNitro MachForm v30 exposes sensitive database contents to unauthenticated remote attackers via the ap_form_{id} parameter. An attacker can craft a malicious SQL statement targeting this parameter to read arbitrary data from the underlying database, including credentials, form submissions, and configuration data. No public exploit code exists in CISA KEV, though a GitHub repository specifically referencing this CVE (nabeelmkhan/CVE-2026-78837) and a PacketStorm entry suggest proof-of-concept material is publicly available; EPSS sits at 0.21% (11th percentile), indicating limited observed exploitation despite the accessible attack surface.
Improper input validation in the TopicRegion component of Apache ActiveMQ allows an authenticated broker client to forge the clientId field in a durable subscription removal request, causing the broker to delete a subscription belonging to a different, legitimate client. All ActiveMQ deployments in the 5.x line before 5.19.11 and the 6.x line before 6.3.2 are affected across all platforms. With EPSS at 0.20% and no active exploitation observed, real-world urgency is moderate, though the silent integrity impact on guaranteed-delivery messaging architectures makes prompt patching advisable.
Denial of service in Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an unauthenticated attacker within Bluetooth range to crash the device by sending a specially crafted L2CAP packet targeting the btm_acl_handle() function. The vulnerability stems from uncontrolled resource consumption (CWE-400) in the Bluetooth stack's ACL connection handler, causing the firmware to exhaust resources or reach an unhandled state upon receipt of malformed input. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.17%, indicating low current threat activity.
Remote code execution across Android versions 14 through 17 is possible via a use-after-free condition triggered by a race condition in multiple OS locations. The CVSS vector (AV:N/AC:H/PR:L/UI:N) places this as a network-reachable, low-privilege attack requiring no user interaction but demanding precise timing due to the race condition mechanics, with full confidentiality, integrity, and availability impact on successful exploitation. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low current observed exploitation pressure despite the broad attack surface spanning essentially all actively supported Android versions.
XML External Entity injection in Distribution Management v1.0.0's level-rule module allows unauthenticated remote attackers to read arbitrary server-side files, conduct server-side request forgery to map internal networks, and potentially launch attacks against internal services by supplying a crafted XML payload. The CVSS vector confirms full confidentiality impact with no authentication barrier, though EPSS at 0.16% (6th percentile) indicates low observed exploitation activity. A public researcher writeup with a proof-of-concept payload has been published on GitHub, confirming practical exploitability.
JWT token forgery in yfexam-exam v2.0 exposes any authenticated session to impersonation because the signing secret is derived entirely from the username and the current calendar month - two low-entropy, often-public values - rather than a server-side cryptographic secret. An attacker who knows or can enumerate a target's username can deterministically compute the signing secret (only 12 possible month values) and mint forged tokens claiming arbitrary privileges without ever knowing the target's password. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.14% (4th percentile), but a public GitHub writeup by fangtang7 documents the technique, materially lowering the bar for any attacker who targets this application.
Sensitive kernel memory is exposed to local non-privileged user processes through improper GPU memory processing operations in Arm's Valhall GPU Kernel Driver and 5th Gen GPU Architecture Kernel Driver. The flaw spans a wide driver revision range - Valhall from r29p0 through r55p0 and 5th Gen from r41p0 through r55p0 - covering Mali-G series and Immortalis GPU generations deployed across hundreds of millions of Android and embedded devices. No public exploit code has been identified and EPSS sits at 0.14% (4th percentile), but the kernel-level confidentiality impact and the OEM-dependent patch delivery path make timely remediation structurally difficult.
Privilege escalation in Okta Hyperdrive Integration Plugin (versions 1.2.0 through pre-1.5.2) stems from the plugin resolving a .NET assembly path via the current user's HKCU registry hive and loading it with Assembly.LoadFrom without any signature or integrity check. A local attacker with standard user privileges who can write to the relevant HKCU registry key can redirect the load path to a malicious DLL, which then executes within the host process or elevated installer context - achieving privilege escalation beyond the attacker's normal trust boundary. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Unauthenticated remote information disclosure in Windows Failover Cluster exposes sensitive process memory to network attackers via a use of uninitialized resource flaw (CWE-908). Affected builds span Windows Server 2019, 2022, and 2025 as well as Windows 10 Version 1809 - all reachable without credentials per the AV:N/PR:N CVSS vector. Microsoft has released patches through the standard MSRC update guide; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Remote code execution in Windows Deployment Services (WDS) via a use-after-free memory corruption flaw allows a low-privileged, network-accessible attacker to execute arbitrary code on affected Windows Server installations. Microsoft confirmed the vulnerability across Windows Server 2012 through 2025 and select Windows 10 builds, with patched build versions identified for each release. No active exploitation or public exploit code has been identified at time of analysis, but the full confidentiality/integrity/availability impact of successful exploitation makes this a material patching priority for organizations running WDS.
Null pointer dereference in the Windows SMB Server network transport driver (srvnet.sys) enables unauthenticated remote attackers to crash affected Windows systems via a network-based denial-of-service attack. Exploitation requires no credentials and no user interaction, targeting SMB-exposed Windows 11 and Windows Server 2022/2025 endpoints. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the flaw.
Use-after-free in Windows Deployment Services (WDS) allows authenticated network attackers to execute arbitrary code on affected Windows Server hosts ranging from Server 2012 through Server 2025. The CVSS vector (AV:N/AC:H/PR:L) confirms network reachability but requires at least low-privilege credentials and elevated exploitation complexity, consistent with the description's 'authorized attacker' phrasing. No public exploit code or CISA KEV listing exists at time of analysis; vendor patch is available.
Buffer over-read in the Windows Message Queuing (MSMQ) Queue Manager allows remote, unauthenticated attackers to disclose arbitrary process memory contents across a broad spectrum of Windows desktop and server versions. The CWE-126 root cause means a crafted MSMQ network message causes the Queue Manager to read past its allocated buffer boundary, potentially returning heap or stack memory-including credentials, session tokens, or application secrets-in network responses. No public exploit code or CISA KEV listing is present at time of analysis; Microsoft has released patches covering Windows Server 2012 through 2025 and Windows 10 through 11.
Out-of-bounds read in the Windows Mobile Broadband driver stack enables unauthenticated remote attackers to disclose sensitive memory contents over a cellular network connection. Affected systems span Windows 10 (21H2, 22H2) and Windows 11 (23H2 through 26H1) before their respective patched builds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS PR:N/AV:N vector indicates no authentication or user interaction is required for exploitation.
Use-After-Free (CWE-416) in the Windows Routing and Remote Access Service enables an unauthenticated attacker positioned on an adjacent network to execute arbitrary code on affected Windows systems. The vulnerability spans a wide range of Microsoft platforms from Windows Server 2012 through Windows Server 2025 and Windows 10/11 client versions, making the exposure surface substantial in enterprise environments where RRAS is deployed as a VPN or routing endpoint. Microsoft has released patches addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS C:H/I:H/A:H impact and adjacent-network unauthenticated attack path make it a high-priority patching target for organizations running RRAS-enabled servers.
Memory exhaustion in Windows Active Directory Domain Services enables unauthenticated remote attackers to crash or severely degrade the AD DS service by repeatedly triggering a memory leak (CWE-401), denying authentication and directory services to all domain-joined systems. Affected builds span Windows Server 2022, Windows Server 2025, and multiple Windows 11 release channels (23H2 through 26H1). No public exploit has been identified at time of analysis, though the unauthenticated network vector (PR:N, AV:N) makes this a significant priority for enterprise environments where AD DS availability is business-critical.