Windows Active Directory CVE-2026-50682

Exploitation requires the attacker to already hold valid low-privileged domain credentials (CVSS PR:L - authenticated), and network reachability to the Active Directory service on a domain controller. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so no special non-default configuration is called out in the description beyond the target running Active Directory on an affected Windows/Windows Server build. The limiting factors that reduce realistic risk are the authentication requirement (an unauthenticated external attacker cannot trigger it directly) and the impact ceiling - this yields denial of service and at most minor information disclosure, not remote code execution.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H (base 7.1) describes a low-complexity, network-reachable attack requiring only low privileges and no user interaction, with high availability impact and minor confidentiality impact. This is a real but bounded risk: the dominant outcome is denial of service against a domain controller - a high-value target whose outage can disrupt authentication domain-wide - rather than code execution or full data compromise (I:N, C only Low). Mitigating the urgency, PR:L means the attacker must already hold valid (even low-privileged) domain credentials, which narrows the population of realistic attackers to authenticated insiders or actors who have already gained a foothold. No KEV listing and no POC are present in the provided data, and no EPSS score was supplied, so there is no evidence of active or widespread exploitation. Net: prioritize patching because AD is critical infrastructure and the attack is low-complexity, but this is not an unauthenticated wormable RCE - it is an authenticated DoS.

An attacker who has obtained low-privileged domain credentials (for example a compromised standard user account) sends a specially crafted request over the network to a domain controller, triggering the out-of-bounds read and crashing or hanging the Active Directory service. With the DC unavailable, domain authentication and directory lookups fail across the environment. No public exploit code is identified at time of analysis, and the low attack complexity means a working exploit, once developed, would be reliable.