What is the CVSS score of CVE-2026-50366?

CVE-2026-50366 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.8%.

Is there a patch available for CVE-2026-50366?

Yes, a patch is available for CVE-2026-50366. Update the affected software to the latest version immediately.

Active Directory Domain Services CVE-2026-50366

EUVD-2026-43903 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-07-14 microsoft

GHSA-cp95-gm7p-7v66

Denial Of Service Null Pointer Dereference Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

6.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable AD DS crash requires only low-privilege domain credentials; no confidentiality or integrity impact, pure availability denial.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 17:27 vuln.today

CVE Published

Jul 14, 2026 - 17:06 cve.org

MEDIUM 6.5

DescriptionCVE.org

Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.

AnalysisAI

Null pointer dereference in Active Directory Domain Services (AD DS) on Windows allows an authenticated, network-adjacent attacker to crash the service and deny domain authentication to all dependent users and systems. Affecting Windows 10 versions 1607 through 22H2, Windows 11 versions 24H2 through 26H1, and Windows Server 2012 through 2025, this vulnerability carries a CVSS 6.5 with high availability impact. No public exploit identified at time of analysis and CISA SSVC assesses exploitation as none with non-automatable attack path, keeping real-world urgency at moderate despite the breadth of affected platforms.

Technical ContextAI

Active Directory Domain Services is the Microsoft implementation of LDAP-based directory services and Kerberos authentication central to enterprise Windows environments. CWE-476 (Null Pointer Dereference) indicates the AD DS service dereferences a pointer that has not been validated for NULL, causing an unhandled exception and process crash. The vulnerability is present across a very wide CPE surface: cpe:2.3:a:microsoft:windows_10_version_1607 through windows_server_2025, spanning OS builds from 6.2.9200 (Server 2012) to 10.0.28000 (Windows 11 26H1). Because AD DS is a core Windows role rather than an optional add-on, it is enabled by default on all domain controllers, making the attack surface deterministic wherever DC roles are deployed. The AV:N/PR:L CVSS vector confirms the flaw is reachable over the network by any low-privilege authenticated principal - no elevated rights are required to trigger the crash.

RemediationAI

Apply the Microsoft-released patch via Windows Update or WSUS targeting the specific fix builds per platform: Windows Server 2012 to 6.2.9200.26226, Server 2012 R2 to 6.3.9600.23291, Windows 10 1607 and Server 2016 to 10.0.14393.9339, Windows 10 1809 and Server 2019 to 10.0.17763.9020, Windows 10 21H2 to 10.0.19044.7548, Windows 10 22H2 to 10.0.19045.7548, Server 2022 to 10.0.20348.5386, Windows 11 24H2 and Server 2025 to 10.0.26100.8875 (client) and 10.0.26100.33158 (server respectively), Windows 11 25H2 to 10.0.26200.8875, and Windows 11 26H1 to 10.0.28000.2269. Full update guidance is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50366. As a compensating control while patching is scheduled, restrict network access to LDAP (TCP/UDP 389, 636) and Kerberos (TCP/UDP 88) ports on domain controllers to only trusted subnets and authenticated management hosts via firewall ACLs; note this may disrupt legitimate domain operations if misconfigured. Environments with multiple domain controllers should ensure AD replication and failover are functioning so a single-DC crash does not fully deny authentication. Windows Server 2012 and 2012 R2 are past end-of-support; if Extended Security Updates (ESU) are not in place, upgrade path should be accelerated.