Active Directory CVE-2026-49178

Exploitation requires the target host to be running Active Directory Domain Services (a domain controller) reachable over the network, and the attacker must already hold valid low-privileged authenticated access to the domain (CVSS PR:L), so this is not exploitable by a fully anonymous/unauthenticated attacker. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning once an authenticated foothold and network path to the DC exist, no special non-default configuration is indicated in the description. The primary limiting factors are the requirement for prior authentication and network reachability to AD DS service ports on a domain controller.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high impact to confidentiality, integrity, and availability - a serious profile because the target is the domain controller itself, compromise of which effectively means compromise of the entire domain. Balancing signals: PR:L means the attacker must already hold some authenticated foothold (e.g., a standard domain account), which materially lowers the pool of attackers versus a fully unauthenticated bug, and there is no EPSS score, no POC, and no KEV listing provided, so there is no evidence of active or imminent mass exploitation. However, because any low-privileged domain user can potentially reach AD DS network interfaces, and successful exploitation yields full DC takeover, this should be treated as a real priority to patch rather than a high-CVSS-but-low-real-risk issue. EPSS data is absent from the input and cannot be cited; SSVC/automatable status is not provided.

An attacker who has obtained valid low-privileged domain credentials (for example via phishing or a reused password) sends specially crafted requests over the network to a vulnerable domain controller's AD DS interface, triggering the heap overflow and executing code in the AD DS process context to seize control of the domain. No user interaction is required and attack complexity is low, so a single compromised standard account can be escalated into full domain compromise. No public exploit identified at time of analysis.