CVE-2026-45648: Windows Active Directory Domain Services Remote Code Execution Vulnerability

Synopsis

Stack-based buffer overflow in Windows Active Directory Domain Services allows a network-reachable attacker with a low-privilege account to execute arbitrary code on affected domain controllers. The vulnerability is exploitable over the network without victim interaction, and successful exploitation gives the attacker full control of the target system, including read, write, and crash capabilities. Patched-image rebuilds at versions 10.0.20348.5256 and 10.0.26100.32995 are available on HarborGuard for environments running affected versions of Windows Server 2022 or Windows Server 2025.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Active Directory Domain Services endpoint over the network; the service must be exposed to the attacker's network segment.

• AuthenticationRequired

  Any low-privilege domain account is sufficient; no administrative or elevated credentials are needed to trigger the overflow.

• Victim interactionNot required

  The attacker does not need to trick or involve any user to carry out the exploit.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layout, or unusual environmental factors are required.

Blast Radius

• Reads sensitive Active Directory data, including credential material, account hashes, and directory objects stored on the domain controller.
• Modifies directory objects, group memberships, and access-control entries, enabling persistent privilege escalation across the domain.
• Crashes the Active Directory Domain Services process, disrupting authentication and authorization for every system in the domain.
• Full remote code execution on the domain controller gives the attacker a foothold to pivot laterally to other domain-joined hosts.