Active Directory EUVD-2026-100132

Exploitation requires network reachability to a domain controller running Active Directory Domain Services; no authentication is needed (PR:N) and no user interaction is required (UI:N). The key limiting factor is CVSS AC:H - the attacker must satisfy a specific condition outside their control (such as a timing window or race, or particular directory state) for the incorrect authorization check to be bypassed, so exploitation is not a single deterministic request against a default configuration. This affects the AD DS role specifically; member servers and clients not acting as domain controllers are not the exploitation target, which bounds real-world exposure to DC-hosting systems.

This is a genuinely high-priority flaw with important caveats. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated vulnerability in Active Directory Domain Services yielding high confidentiality, integrity and availability impact - code execution against the directory service that underpins enterprise identity, which is why the base score is 8.1. The single most mitigating signal is AC:H (high attack complexity): successful exploitation depends on conditions outside the attacker's direct control (e.g. timing, specific state, or a race), which meaningfully lowers the ease of reliable, scaled exploitation. No EPSS probability was supplied, so automated exploitation likelihood cannot be quantified. KEV status is not present in the input, so there is no evidence of active exploitation; likewise no POC is indicated. SSVC-style framing: exploitation = none observed, technical impact = total (full compromise of a domain controller), automatable = likely NO given AC:H. The one data tension worth flagging: the input Tag says 'Authentication Bypass' while the description and CWE-863 both describe incorrect authorization - these are related but distinct, and the vulnerability is more precisely an authorization flaw than an authentication bypass. Net: treat as a priority patch for any domain controller because of impact and unauthenticated network reach, but the AC:H and absence of exploitation/POC signals argue against treating it as an imminent mass-exploitation event.

A remote, unauthenticated attacker with network access to a domain controller sends crafted requests that abuse an incorrect authorization check in Active Directory Domain Services to gain code execution on the DC. Because AC:H, the attacker must win a race or satisfy specific environmental conditions, so exploitation is not trivially repeatable. No public exploit identified at time of analysis.