Active Directory Domain Services EUVD-2026-73009

The target must have the Active Directory Domain Services server role installed and running - this is standard on all Windows domain controllers. The CVSS PR:N vector confirms no authentication is required; a network-reachable attacker with no credentials can attempt exploitation against the AD DS protocol listener. AC:H indicates the exploit is not straightforward: specific heap conditions, object lifecycle timing, or repeated request sequencing is required to reliably achieve code execution rather than a simple crash. Windows 10/11 client builds are listed as affected but the primary risk scenario is domain controllers. No non-default configuration is required; any system serving the AD DS role on an unpatched build is within scope. Network isolation from untrusted hosts limits exposure but does not eliminate insider or post-compromise pivot risk.

The CVSS 8.1 score with AV:N/AC:H/PR:N/UI:N reflects a high-severity network-reachable vulnerability requiring no authentication, though AC:H indicates exploitation is non-trivial - likely demanding precise heap manipulation or race condition timing. The full C:H/I:H/A:H impact triad means successful exploitation yields complete compromise of a domain controller, which in turn enables domain-wide lateral movement, credential harvesting via DCSync, and ransomware deployment. No EPSS data was provided in the input, and the CVE does not appear in CISA KEV, suggesting active widespread exploitation has not been confirmed; however, even a mid-sized municipal IT team in mielec should treat this as urgent, given that domain controllers represent the highest-value targets in enterprise ransomware and APT intrusion chains. The absence of a public exploit and the AC:H barrier moderately reduce near-term opportunistic risk, but the extraordinary value of domain controller access makes this a top-priority patch target regardless.

An unauthenticated attacker with network access to a domain controller's AD DS service ports sends a sequence of malformed protocol messages - likely crafted LDAP requests or MSRPC calls - that trigger a use-after-free condition in the AD DS heap. The attacker then sends follow-on requests to manipulate the freed memory region into a controlled state, redirecting execution flow. Successful exploitation yields code execution in the context of the AD DS service (typically SYSTEM), granting the attacker full domain controller access and enabling DCSync-style credential extraction or ransomware deployment. No public exploit code has been identified at time of analysis.