Windows Server CVE-2026-50424

The target must be running the Windows Domain Controller role on an affected build (Windows Server 2025, Server Core, or the Windows 11 24H2/25H2/26H1 code line), and the attacker needs network reachability to the DC's authentication service ports. No authentication, no privileges and no user interaction are required (AV:N/AC:L/PR:N/UI:N), so exploitation works against default domain-controller configurations that expose standard AD services. The main limiting factors are network exposure - a DC segmented behind firewalls and only reachable from trusted internal subnets sharply reduces the attack surface - and the impact ceiling: this is availability-only (A:H, C:N/I:N), so a successful attack causes service disruption, not code execution or data theft.

The CVSS 3.1 base score is 7.5 (High) driven entirely by availability: AV:N (network-reachable), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction), with C:N/I:N/A:H - a clean remote unauthenticated DoS, no code execution or data exposure. The low attack complexity and no-auth requirement make it easy to trigger, but impact is confined to service disruption. No EPSS score and no SSVC decision data were provided, and there is no POC or CISA KEV listing, so real-world exploitation is currently theoretical rather than observed - likely low near-term probability but high consequence given DCs are single points of failure for an entire domain. One conflict to flag: the vendor Tags include 'Authentication Bypass', which contradicts the description (denial of service) and the CVSS vector (I:N, C:N) - treat the DoS characterization from the description/CVSS as authoritative and verify the 'Authentication Bypass' tag against the MSRC advisory, as it may be a mis-tag or indicate a secondary effect.

An attacker with network access to a domain controller sends a crafted request to a DC service that carries a malformed pointer-bearing structure; the DC dereferences the untrusted pointer and the authentication service faults, dropping or hanging domain logons for all clients that rely on that DC. No credentials or user interaction are needed (PR:N/UI:N/AC:L), so an unauthenticated actor on a reachable network segment can repeat the trigger to sustain the outage. No public exploit is identified at time of analysis.