Active Directory Domain Services CVE-2026-69809

No special configuration is required beyond the default deployment of a Windows domain controller with the AD DS role installed and network-reachable. The CVSS vector PR:N/AV:N/AC:L/UI:N confirms exploitation is possible by any unauthenticated remote attacker with network access to the target domain controller on standard AD ports (LDAP 389/636, Kerberos 88). Limiting factors: the attack requires network reachability to the domain controller - organizations that segment DCs behind strict internal firewall rules and block external access significantly reduce exposure. The impact is limited to availability (A:H); there is no confidentiality or integrity component.

CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures the network-reachable, unauthenticated nature and availability-only impact. EPSS data was not provided in the source intelligence; no KEV listing and no public exploit code have been identified, indicating this has not yet seen widespread exploitation. Despite the moderate CVSS score, the real-world business risk is disproportionately high: AD DS is the authentication and authorization backbone of Windows enterprise environments, and its outage cascades - domain logins fail, Group Policy cannot apply, and downstream services lose Kerberos tickets. Any internet-exposed domain controller would be particularly vulnerable. The tag 'Authentication Bypass' applied to this CVE is incorrect and misleading - this is a pure availability (DoS) vulnerability with no authentication bypass component. Defenders should prioritize patching on internet-accessible or perimeter-adjacent domain controllers first.

An unauthenticated attacker on the network - including from the internet if DC ports are exposed - sends a stream of crafted pre-authentication requests (e.g., malformed LDAP binds or Kerberos AS-REQs) to a domain controller. Each request causes the AD DS process to allocate memory that is never freed, steadily exhausting available memory until the service crashes or becomes unresponsive. All domain-joined machines subsequently fail to authenticate users or apply Group Policy, effectively denying service across the enterprise. No public exploit code has been identified at time of analysis.