IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Windows Active Directory Domain Services: Denial of service via out-of-bounds read

CVE-2026-83647High 7.5

← All vulnerabilities

Summary

An out-of-bounds read in Active Directory Domain Services (AD DS) on Windows allows an unauthenticated attacker on the network to cause a denial of service. No credentials or user interaction are required. A successful attack can disrupt the directory service on affected domain controllers and thereby block logons across the business.

Affected

  • Windows Server 2016 (build 10.0.14393.0 to < 10.0.14393.9612), including Server Core
  • Windows Server 2019 (build 10.0.17763.0 to < 10.0.17763.9376)
  • Windows Server 2012 R2 (build 6.3.9600.0 to < 6.3.9600.23470), including Server Core
  • Windows 10 Version 1607 (build 10.0.14393.0 to < 10.0.14393.9612), listed in the CPE data
  • Windows 10 Version 1809, 21H2, 22H2 and Windows 11 23H2, 24H2, 25H2, 26H1, 26H2 (ranges as listed in the CVE record)
  • Note: the complete MSRC product table could not be fully verified.

Fixed in

  • Windows Server 2016 and Windows 10 1607: build 10.0.14393.9612 or later (unverified mapping to KB5126868, confirm on MSRC)
  • Windows Server 2019 and Windows 10 1809: build 10.0.17763.9376 or later (Tenable lists KB5126651, unverified)
  • Windows Server 2012 R2: build 6.3.9600.23470 or later
  • Windows 11 and Windows 10 21H2/22H2: see MSRC for the fixed builds

Workaround

  • No vendor workaround known.
  • Restrict which hosts can reach domain controllers at the network level.

Exploitation

  • CISA SSVC: exploitation none, automatable yes, technical impact partial.
  • EPSS about 1.3 percent (0.01298).
  • MSRC exploit maturity: unproven.
  • No public proof of concept or in-the-wild exploitation found in a limited search.

Our recommendation

  • Check which hosts actually run the AD DS role; the Windows 10 1607 CPE entry may be a mapping artifact.
  • Install the October 2026 security update on all domain controllers and verify the fixed build on the MSRC page.
  • Upgrade any Windows 10 1607 system still in use, since it no longer receives updates.
  • Limit access to domain controllers to required hosts and monitor for service outages or unusual traffic to them.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Denial of service – Active Directory Domain Services
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation unlikely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:53.

Original description (NVD)

Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed