Executive brief
A vulnerability in Windows Active Directory, the central service used to manage users and computers on a corporate network, could allow an attacker to crash the system. By sending a specially crafted request over the network, an unauthorized user can trigger an infinite loop that makes the directory service unresponsive. This results in a denial-of-service, preventing employees from logging in or accessing network resources.
Technical details
A denial-of-service vulnerability exists in Windows Active Directory due to an infinite loop (CWE-835) triggered by an unreachable exit condition. An unauthenticated attacker can exploit this by sending a malicious request over the network to an affected Active Directory instance. Successful exploitation causes the service to hang or become unresponsive, leading to a complete loss of availability for directory services. The vulnerability affects multiple versions of Windows 10, Windows 11, and Windows Server 2012. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows 10 Version 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 Version 24H2, 25H2, 26H1
- Microsoft Windows Server 2012 All versions including Server Core
- Microsoft Windows Active Directory
Timeline
- 2026-07-14: advisory: Initial publication by Microsoft and NVD
- 2026-07-14: patched: Security updates released by Microsoft