Windows Active Directory CVE-2026-65777

The attacker must hold at least low-level domain credentials (PR:L), confirming this is not an unauthenticated attack surface. Network access to Active Directory services (typically TCP 88 for Kerberos, TCP/UDP 389 for LDAP, or TCP 636 for LDAPS) on a domain controller is required (AV:N). High attack complexity (AC:H) implies that additional conditions must be met beyond simply initiating a connection - likely requiring on-path network positioning to intercept or downgrade a cryptographic negotiation, or the ability to force a specific authentication flow that exposes the weak encryption path. Exploitation is not automatable per SSVC, meaning mass scanning or worm propagation is not a realistic threat model. The flaw does not affect availability or confidentiality - only the integrity of an AD security enforcement mechanism, limiting the blast radius to authentication bypass scenarios rather than credential theft or service disruption.

The CVSS base score of 5.3 (Medium) reflects a meaningful but bounded risk profile. The AC:H metric is the principal mitigant: exploiting a cryptographic weakness at this level typically requires specialized tooling, favorable network positioning, or the ability to intercept or manipulate authentication traffic - not a trivial, point-and-click attack. PR:L further constrains the attacker pool to those already holding some domain credentials. SSVC reinforces this: exploitation status is none, the attack is not automatable, and technical impact is rated only partial. The I:H CVSS impact rating - high integrity, no confidentiality or availability - indicates the attacker goal is specifically to bypass a security enforcement mechanism rather than exfiltrate data or cause disruption. EPSS data is not provided; given the AC:H complexity and SSVC 'none' exploitation status, real-world exploitation probability at scale is assessed as low. This is not a 'patch immediately at 3am' scenario, but it should be included in the next scheduled patching cycle given the breadth of affected Windows versions and the criticality of Active Directory to enterprise identity infrastructure.

A low-privileged domain user with network access to a domain controller initiates an authentication exchange and leverages the weak cryptographic implementation to manipulate or forge elements of the AD security protocol, bypassing an integrity-enforcing security feature. Given AC:H, this likely requires the attacker to be positioned to intercept or replay authentication traffic, for example via an on-path position on a corporate LAN segment. No public exploit identified at time of analysis, so this scenario currently requires custom tooling or significant cryptographic expertise.