Active Directory Domain Services CVE-2026-69546

Exploitation requires network reachability to ADDS-facing ports on an unpatched Windows system - specifically TCP/UDP 389 (LDAP), 636 (LDAPS), or 88 (Kerberos) on a system running the Active Directory Domain Services role. The CVSS PR:N and UI:N metrics confirm no authentication and no user interaction are required. The AC:H metric indicates exploitation is technically demanding, likely involving a race condition or specific heap-state dependency within the ADDS service - reliable exploitation requires more than a single crafted packet. Key limiting factors: domain controllers are rarely internet-exposed, so exploitation from untrusted networks generally requires prior network presence such as a compromised perimeter host, VPN access, or insider position; Windows client systems (Windows 10/11) listed in affected versions may expose a narrower ADDS client-side attack surface rather than the full server-side exposure. Systems not running the ADDS role are likely unexposed to the primary attack surface, though this boundary is not explicitly confirmed in available vendor data.

The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) presents a nuanced risk profile: the combination of network reachability and no authentication requirement makes every exposed ADDS instance a candidate target, yet the High Attack Complexity rating signals that reliable exploitation is non-trivial - likely demanding heap grooming, race-condition timing, or specific ADDS state that raises the bar for weaponization. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, making opportunistic mass exploitation unlikely in the near term. However, the strategic value of domain controllers cannot be overstated: a successful exploit on an ADDS host grants code execution on a system holding Kerberos ticket-granting authority and the full AD schema, enabling immediate lateral movement and complete domain compromise. Given this cascading blast radius, even a mid-sized municipal IT team in zabrze should treat this as urgent patching priority rather than a deferred maintenance item - the AC:H bar is achievable by motivated threat actors with targeted tooling. The absence of EPSS data in the provided intelligence is a gap; defenders should monitor MSRC and threat-intelligence feeds for any shift in exploitation status.

An unauthenticated attacker with network reachability to a domain controller sends a crafted sequence of ADDS protocol messages designed to manipulate heap allocation timing or state, triggering a use-after-free in the ADDS service process. After achieving controlled write into freed memory - requiring heap grooming or race-condition exploitation - the attacker redirects execution to shellcode running in the context of the ADDS service, which typically operates as SYSTEM, granting complete control of the domain controller and, by extension, the entire Active Directory domain. No public exploit code exists at time of analysis, and the AC:H complexity metric indicates this requires targeted effort rather than simple scripted delivery.