Windows Active Directory Domain Services: Denial of service via out-of-bounds read

Summary

Microsoft has fixed a denial-of-service vulnerability in Windows Active Directory Domain Services (AD DS), the directory service that handles domain authentication on Windows Server domain controllers. The flaw is an out-of-bounds read (CWE-125). An authorized attacker with a valid account on the network can crash the service, which affects availability only. Exploitation is not known and no public proof of concept was found.

Affected

• Windows 10 Version 1607, 1809, 21H2 and 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2
• Windows Server 2016, 2019 and 2022 (including Server Core installations)

Versions as listed in the CNA record. Not yet verified against the MSRC entry; third-party aggregators disagree.

Fixed in

• Windows 10 1607 / Server 2016: build 10.0.14393.9688 or later
• Windows 10 1809 / Server 2019: build 10.0.17763.9487 or later
• Windows 10 21H2: build 10.0.19044.7846 or later
• Windows 10 22H2: build 10.0.19045.7846 or later
• Windows 11 23H2: build 10.0.22631.7711 or later
• Windows 11 24H2: build 10.0.26100.9974 or later
• Windows 11 25H2: build 10.0.26200.9974 or later
• Windows 11 26H1: build 10.0.28000.3501 or later
• Windows 11 26H2: build 10.0.26300.9974 or later
• Windows Server 2022: build 10.0.20348.5870 or later

Fixed in the November 2026 Patch Tuesday security updates (released 2026-11-10). The Server 2022 KB reported by a third party (KB5131090) is unverified; check the MSRC advisory for the correct KB per build.

Workaround

Unknown.

Exploitation

• Not known to be exploited in the wild.
• CISA SSVC: exploitation none, not automatable, partial technical impact.
• Rapid7 rates exploitation as less likely; no public proof of concept found.
• Not listed in the CISA KEV catalog.

Our recommendation

• Apply the November 2026 security updates to all domain controllers first, then to other Windows Server and client systems in the normal monthly cycle.
• Check that all domain controllers are patched and that AD replication works after patching.
• Make sure you have more than one domain controller, so a crash does not stop logins and file access.
• Restrict who holds valid domain accounts and keep domain controllers behind the firewall.
• Monitor domain controllers for unexpected service crashes or restarts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105568 msrc.microsoft.com
• Strix AI: CVE-2026-105568 www.strix.ai
• BleepingComputer: Microsoft November 2026 Patch Tuesday www.bleepingcomputer.com
• Rapid7: Patch Tuesday November 2026 (EM) www.rapid7.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:38.