Active Directory Domain Services CVE-2026-50366

The attacker must hold valid low-privilege domain credentials (PR:L per CVSS vector) - a standard Active Directory user account is sufficient; no administrative rights are required. The attack is delivered over the network (AV:N) to a host running the Active Directory Domain Services role (i.e., a domain controller); workstations and member servers without the AD DS role installed are not directly vulnerable. No user interaction is required (UI:N). The non-automatable SSVC rating implies the triggering condition likely requires a specific crafted request payload rather than trivial mass-scanning. Exploitation is limited to environments where AD DS is deployed - standalone workgroup machines are unaffected. The primary limiting factors are: (1) valid domain credentials must be obtained first, (2) network reachability to a DC is required, and (3) environments with multiple DCs and automatic service recovery may experience only brief disruption per attack attempt.

CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly reflects a network-reachable, low-complexity denial-of-service with no confidentiality or integrity impact. The EPSS score of 0.76% (51st percentile) is below average exploitation probability, consistent with CISA SSVC rating exploitation as 'none' and automatable as 'no' - the non-automatable designation suggests the attack requires some deliberate targeting rather than mass scanning. KEV status is absent, confirming no confirmed active exploitation. Technical impact is rated 'partial' by SSVC, aligning with the scoped availability-only impact. The primary real-world risk is availability of domain authentication: crashing AD DS on a domain controller disrupts logins, Group Policy, and any Kerberos-dependent service until the DC recovers or failover occurs. In environments with multiple DCs and AD site replication, impact may be limited to a single DC; in smaller or single-DC environments, impact is severe. The combination of low EPSS, no KEV, and non-automatable SSVC classification positions this as a genuine but lower-urgency patch-cycle item rather than an emergency out-of-band response - unless the environment runs single-DC or has no AD redundancy.

An attacker with valid low-privilege domain credentials - such as a standard employee account or a compromised service account - sends a specially crafted network request to the Active Directory Domain Services interface on a domain controller. The malformed input triggers a null pointer dereference in the AD DS process, causing it to crash and rendering domain authentication unavailable until the service restarts or administrators fail over to a redundant DC. No public exploit identified at time of analysis, but the low authentication bar makes this accessible to any insider or lateral-movement attacker with foothold in the domain.