EUVD-2026-73009
GHSA-w546-g5m3-p2w5
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable UAF in AD DS; AC:H reflects heap-state manipulation or race condition requirement; PR:N per 'unauthorized attacker' description; full C/I/A from SYSTEM-level RCE on domain controller.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
5DescriptionCVE.org
Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Windows Active Directory Domain Services allows unauthenticated network attackers to exploit a use-after-free memory corruption flaw and execute arbitrary code on domain controllers. The vulnerability spans virtually the entire Windows Server ecosystem from 2012 through 2025 and extends to Windows 10 and Windows 11 client builds running AD DS components, creating an exceptionally broad attack surface across enterprise environments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must have the Active Directory Domain Services server role installed and running - this is standard on all Windows domain controllers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score with AV:N/AC:H/PR:N/UI:N reflects a high-severity network-reachable vulnerability requiring no authentication, though AC:H indicates exploitation is non-trivial - likely demanding precise heap manipulation or race condition timing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Microsoft's patches via Windows Update using the build numbers enumerated per platform in the EUVD-2026-73009 advisory, with the MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69524 as the authoritative source. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct complete inventory of all Windows domain controllers (Server 2012-2025) and systems running AD DS components, prioritizing production infrastructure in the assessment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today