Active Directory EUVD-2026-99321

The target host must be a domain controller running the Active Directory Domain Services role, and the attacker must already hold low-privileged authenticated access to the network (PR:L) - a valid domain account or equivalent foothold is a hard prerequisite, so a fully external unauthenticated attacker cannot trigger this directly. No user interaction is required (UI:N) and attack complexity is low (AC:L) once authenticated. Impact is strictly availability (A:H; C:N/I:N) - the attack crashes or hangs the AD DS service and cannot read or modify data. Exploitation is limited to the enumerated unpatched build ranges (e.g., Windows Server 2012 through Server 2025 and Windows 10/11 builds below the fixed versions listed in EUVD-2026-99321).

This is a moderate-priority, availability-only vulnerability that does not warrant emergency treatment despite affecting a critical infrastructure component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) describes a network-reachable but authenticated (PR:L) denial-of-service with no confidentiality or integrity impact - consistent with the CWE-125 out-of-bounds read and the description's 'authorized attacker to deny service.' Multiple real-world exploitation signals point the same direction and are mutually consistent: CISA's SSVC decision framework rates Exploitation as 'none,' Automatable as 'no,' and Technical Impact as 'partial,' and the vulnerability is NOT in CISA KEV and has no public proof-of-concept, yielding an exploitation status of 'no public exploit identified at time of analysis.' EPSS is NOT provided in the input, so probabilistic exploitation likelihood cannot be quantified - state this gap explicitly rather than assuming low risk. The required authentication (PR:L) and the DoS-only impact meaningfully lower the practical priority relative to the raw 6.5 score. The one notable aggravating factor is the target: AD DS runs on domain controllers, so a successful crash denies authentication services domain-wide. Net assessment: patch in normal cadence, prioritizing internet-exposed or multi-tenant domain controllers, but this is not a drop-everything issue.

An authenticated domain user (or an attacker who has already obtained low-privileged domain credentials) sends a crafted request to the AD DS service on a domain controller, triggering an out-of-bounds read that crashes or hangs the service and denies authentication across the domain. Because PR:L is required, a fully unauthenticated external attacker cannot trigger it directly. No public exploit code or active exploitation has been identified at the time of analysis.