EUVD-2026-73534
GHSA-g655-4255-9223
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-facing unauthenticated ADDS service; AC:H reflects heap-grooming or race-condition complexity typical of reliable use-after-free exploitation; full C/I/A impact on compromised domain controller.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution via use-after-free (CWE-416) in Active Directory Domain Services (ADDS) affects an exceptionally broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the memory corruption condition in the ADDS service, potentially yielding arbitrary code execution with full confidentiality, integrity, and availability impact on targeted domain controllers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to ADDS-facing ports on an unpatched Windows system - specifically TCP/UDP 389 (LDAP), 636 (LDAPS), or 88 (Kerberos) on a system running the Active Directory Domain Services role. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) presents a nuanced risk profile: the combination of network reachability and no authentication requirement makes every exposed ADDS instance a candidate target, yet the High Attack Complexity rating signals that reliable exploitation is non-trivial - likely demanding heap grooming, race-condition timing, or specific ADDS state that raises the bar for weaponization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security updates released for this vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Begin by immediately auditing inventory of all domain controllers running Windows Server 2012 through 2025 or Windows 11, assessing their current patch status within 24 hours. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today