CVE-2026-65777: Microsoft Windows Active Directory inadequate encryption strength bypass

CVE-2026-65777 · Severity: medium · CVSS 5.3 · Published 2026-08-11

Windows Active Directory, a core directory service that manages user identities and access control across enterprise networks, contains a weakness in its encryption implementation. An authorized attacker on the network could exploit this flaw to bypass a security feature, potentially compromising access controls or exposing sensitive authentication data.

Technologies: Microsoft Windows Active Directory. Vendors: Microsoft.

Quick answers

Is CVE-2026-65777 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-65777 being exploited in the wild.
How severe is CVE-2026-65777?
Medium severity, with a CVSS score of 5.3, published 11 August 2026.
Which products and versions are affected?
Microsoft Windows Active Directory <UNKNOWN>.
Is there a fix for CVE-2026-65777?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-65777 attacked?
It is attacked over the network.
Am I affected by CVE-2026-65777?
Check whether you run Microsoft Windows Active Directory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability stems from inadequate encryption strength in Windows Active Directory's security mechanisms. An authorized attacker with network access can bypass a security feature by exploiting weak encryption parameters. The attack requires prior authorization to the system and network reachability. Successful exploitation could lead to circumvention of intended security controls. A patch is available from Microsoft.

Affected products

  • Microsoft Windows Active Directory <UNKNOWN>

Timeline

  • 2026-08-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.