Active Directory Domain Services EUVD-2026-43761

Exploitation requires the attacker to hold a valid low-privilege credential within the domain or network context sufficient to authenticate and send requests to Active Directory Domain Services - consistent with the CVSS PR:L metric. The attacker must have network-level access to a domain controller exposing the AD DS service interface (typically LDAP on TCP 389/636 or related protocols). The affected component is Active Directory Domain Services itself, so the vulnerability is only exploitable on systems with AD DS installed and running, primarily domain controllers. Exploitation is limited by the authentication requirement: anonymous or unauthenticated external attackers cannot trigger this flaw directly. Guest accounts, contractor accounts, or compromised low-privilege accounts within the domain would satisfy the credential prerequisite. There is no indication of non-default configuration requirements - any standard AD DS deployment appears to be in scope.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a realistic threat model: network-reachable, low complexity, low privilege, no user interaction required, and high availability impact with no confidentiality or integrity loss. The PR:L metric is critical context - this is not unauthenticated exploitation; an attacker needs a valid domain account or equivalent low-privilege credential before triggering the crash. However, in most enterprise Active Directory deployments, nearly every employee holds such credentials, making the effective prerequisite bar quite low in practice. A crash of AD DS on a domain controller would disrupt authentication and authorization for all systems in the affected domain until the service recovers or the DC is rebooted, which amplifies the real-world impact well beyond what the 6.5 CVSS score alone suggests. No EPSS data was provided and this CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. No public proof-of-concept code has been identified. Despite the absence of active exploitation signals, the broad affected version range, ubiquity of Active Directory in enterprise environments, and low credential threshold make this a legitimate priority for organizations running exposed domain controllers.

A low-privileged domain user or service account holder connects to a domain controller over the network and submits a specially crafted request to the Active Directory Domain Services interface, triggering a null pointer dereference in the AD DS process. The service crashes, causing the domain controller to become unavailable for authentication and LDAP queries, potentially locking out users and disrupting services relying on Active Directory across the environment until the service is restarted or the system reboots. No public proof-of-concept has been identified, so exploitation currently likely requires independent vulnerability research to reproduce.