Active Directory EUVD-2026-73371

Exploitation requires a low-privilege authenticated account in the Active Directory domain (PR:L per CVSS vector); anonymous or unauthenticated access is insufficient. The attacker must have network-level connectivity to the domain controller on the relevant service port (e.g., LDAP TCP 389 or LDAP over SSL TCP 636). The AD DS role must be installed and active on the targeted Windows Server. Exploitation is limited by: the requirement for valid domain credentials, absence of public exploit code, and default network segmentation that typically places domain controllers on internal-only subnets. Client OS versions (Windows 10/11) are in scope only if the AD DS role is explicitly installed, which is non-default.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H scores 6.5 (Medium), reflecting a network-reachable, low-complexity attack requiring only low-privilege authentication with an availability-only impact. The scoring is well-calibrated: the requirement for at least domain-user credentials (PR:L) meaningfully limits the attacker pool compared to a fully unauthenticated flaw. However, the operational consequence of crashing AD DS - loss of domain authentication for all users and services in the domain - is disproportionately severe relative to the CVSS base score; even a mid-sized enterprise IT team should treat this as urgent patching given the blast radius of an AD outage. No public exploit code exists and this vulnerability is not in the CISA KEV catalog, so mass automated exploitation is not currently a concern. EPSS data is not provided. The practical risk is highest in environments where AD DS is Internet-adjacent or where an attacker has already achieved initial access via compromised domain credentials.

A threat actor with any valid domain user account authenticates to a target domain controller over the network and sends a specially crafted LDAP or RPC request designed to trigger the null pointer dereference in the AD DS service. The service process crashes, rendering the domain controller unable to service authentication requests until the service restarts or the system is rebooted, causing a domain-wide authentication outage. No public proof-of-concept code has been identified, meaning exploitation currently requires independent vulnerability research to identify the precise triggering condition.