CVE-2026-88165

Executive Summary

CVE-2026-88165 is an out-of-bounds write vulnerability (CWE-787) in Active Directory Domain Services (AD DS) that permits an authorized, low-privileged attacker to execute arbitrary code over a network. With a CVSS 3.1 base score of 8.8, exploitation requires only low-privileged domain credentials (PR:L) and no user interaction (UI:N), while delivering high confidentiality, integrity, and availability impact. Because AD DS is the authentication and directory backbone for the vast majority of enterprise Windows environments, a remotely reachable memory-corruption flaw in this service represents a high-value lateral-movement and privilege-escalation primitive for any adversary holding even a single valid domain account.

As of this report, no public proof-of-concept, exploit code, or Nuclei template exists, no vendor patch has been identified by any tracked source, and the CVE has not been added to the CISA Known Exploited Vulnerabilities catalog. EPSS has not yet scored this CVE. The absence of a published patch makes prevention and detection the primary defensive levers.

Technical Analysis

The NVD description states, verbatim, that this is an "Out-of-bounds write in Active Directory Domain Services [that] allows an authorized attacker to execute code over a network." The assigned weakness is CWE-787 (Out-of-bounds Write), a memory-safety defect class in which software writes data past the end of an allocated buffer.

At the vulnerability-class level, an out-of-bounds write in a network-facing service follows a recognizable pattern:

1. Input parsing across a trust boundary. AD DS exposes network services (directory, authentication, and replication-related interfaces) that receive and deserialize structured, potentially attacker-influenced data. Where length, count, or offset fields in that data are not validated against the size of the destination buffer, an oversized or malformed value causes the write to exceed the buffer's bounds.
2. Memory corruption. The out-of-bounds write overwrites adjacent memory. Depending on which memory region is reached, this can corrupt heap metadata, function pointers, vtable-style dispatch structures, or other control data that the service later dereferences.
3. Code execution. When the overwritten data is subsequently used to control an indirect call, return address, or pointer dereference, the attacker can redirect execution to attacker-controlled instructions, achieving remote code execution in the security context of the AD DS service process.

The phrase "authorized attacker" in the description is significant: the CVSS vector (PR:L) indicates the flaw is not reachable by a fully unauthenticated network client. The attacker must first possess valid, low-privileged credentials sufficient to reach the vulnerable code path. This does not meaningfully reduce severity in practice — a single compromised workstation or service account in a domain is a routine foothold — but it does shape both the attack chain (authentication is a prerequisite) and detection (successful exploitation will be preceded by an authenticated session).

Insufficient technical detail is available to identify the specific function, protocol message, RPC interface, or buffer involved in the out-of-bounds write. The vendor, affected version range, and vulnerable component details were not provided in the source data. Analysts should treat any claim naming a specific AD DS interface, protocol operation, or code path as unverified until a vendor advisory is published.

Because the flaw resides in a core identity service, the trust implications are elevated beyond a typical RCE: an attacker who achieves code execution within AD DS on a domain controller can potentially read directory data, manipulate authentication material, or pivot to adjacent systems that trust the compromised service.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-787) and the CVSS vector, and is written at the vulnerability-class level to avoid fabricating implementation specifics.

1) Reconnaissance / target identification. The attacker first identifies reachable AD DS endpoints. Domain controllers are discoverable through standard, low-noise means: DNS SRV record lookups for the domain, LDAP/GC service ports, and directory enumeration available to any authenticated domain principal. The attacker needs only a valid low-privileged account (user or service account) to proceed — consistent with PR:L. No phishing or user interaction is required (UI:N, AC:L).

2) Triggering the flaw. The attacker crafts and transmits network input to the vulnerable AD DS code path. Because the defect is an out-of-bounds write, success hinges on supplying data that drives a length, count, or offset value beyond the bounds of the destination buffer. The exact message structure, protocol opcode, and required authentication context are not specified in the available data and must not be assumed. What is derivable: the trigger is a single low-complexity, authenticated, network-delivered request that produces a memory-safety violation.

3) Execution method. Once the out-of-bounds write corrupts adjacent memory, the attacker attempts to convert the corruption into control-flow hijack — overwriting a control structure that the AD DS process subsequently dereferences, so that execution is redirected to attacker-chosen instructions. This is the standard exploitation path for CWE-787 and requires no assumptions about specific function or symbol names. In practice, exploitation of this class is frequently probabilistic (memory layout, mitigations such as ASLR/DEP and their bypasses determine reliability), and NVD provides no reliability or mitigation-bypass details.

4) Post-exploitation impact. Per the CVSS vector, the confidentiality, integrity, and availability impacts are all High. Achieving code execution in the AD DS service context on a domain controller could allow the attacker to access or modify directory and authentication data, disrupt authentication services (availability), and use the compromised host as a pivot into other systems trusting that service. The full blast radius depends on whether the vulnerable component runs on domain controllers, member servers, or both — a detail not established by the available data.

Impact Assessment

CVE-2026-88165 carries a CVSS 3.1 base score of 8.8 (High), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Subscore interpretation:

• AV:N (Network) — exploitable remotely across a network boundary; the attacker does not need local access to the target.
• AC:L (Low) — no special conditions or race windows are required beyond the stated prerequisites.
• PR:L (Low) — the attacker must hold low-privileged, "authorized" access (e.g., a valid domain account); this is the single factor keeping the score below critical.
• UI:N (None) — no victim interaction is required.
• S:U (Unchanged) — impact is scoped to the vulnerable component's security authority.
• C:H / I:H / A:H — full loss of confidentiality, integrity, and availability of the affected service.

Business impact. Active Directory Domain Services underpins authentication, authorization, group policy, and identity for enterprise Windows estates. A remote code execution flaw in this component threatens the integrity of the identity control plane itself. Successful exploitation could enable credential theft, unauthorized directory modification, service disruption, and lateral movement across any system that trusts the compromised domain services.

Blast radius. The affected version range is unknown from the available data, and it is not established whether the vulnerable code resides on domain controllers only or also on member servers and client SKUs. Until a vendor advisory defines affected products and versions, defenders should assume the widest plausible scope and prioritize domain controllers as the highest-value assets. Because no patch is available (0/4 confidence across all tracked sources), every reachable, authenticated endpoint running the affected AD DS component remains exposed.

Detection Guidance

The detection logic below is necessarily generic: it targets authenticated access to Active Directory service interfaces, anomalous LDAP/ADWS/GC traffic patterns, and post-exploitation behaviors consistent with memory-corruption RCE in a directory service. Because no exploit signature exists, these rules emphasize behavioral and volumetric anomalies rather than a precise payload match. Thresholds must be tuned to each environment's baseline; false positives are expected and should be managed through allow-listing of known administrative tooling.

Sigma Rule

title: Suspicious Authenticated Access to Active Directory Domain Services Followed by DC Process Anomaly
id: 8f3c1d2a-7b64-4e9a-9c1e-2a5d6f0b8c11
status: experimental
description: Detects anomalous authenticated LDAP/ADWS/GC access to a domain controller process, potentially indicative of CVE-2026-88165 out-of-bounds write exploitation. Behavioral rule; tune thresholds to environment baseline.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88165
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: windows
  service: security
detection:
  selection_auth:
    EventID: 4624
    LogonType:
      - 3
      - 8
    TargetUserName|endswith: '$'
  selection_service:
    EventID:
      - 4688
    Image|endswith:
      - '\lsass.exe'
      - '\dns.exe'
  timeframe: 5m
  condition: selection_auth and selection_service
falsepositives:
  - Legitimate service account authentication to domain controllers
  - Scheduled replication and backup operations
level: high
tags:
  - attack.t1210

YARA Rule

rule CVE_2026_88165_AD_DS_MemoryCorruption_Indicator
{
    meta:
        description = "Generic indicator rule for AD DS exploitation artifacts; targets suspicious in-memory or on-disk patterns consistent with out-of-bounds write exploitation. No known PoC exists; tune and validate before deployment."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88165"
        cve = "CVE-2026-88165"
        cwe = "CWE-787"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cve = "CVE-2026-88165" ascii wide nocase
        $ads = "Active Directory Domain Services" ascii wide nocase
        $oob = { 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 }

    condition:
        $cve or ($ads and $oob)
}

Suricata IDS Rule

alert tcp any any -> any 389 (msg:"CVE-2026-88165 Potential AD DS Out-of-Bounds Write Exploitation Attempt (LDAP)"; flow:established,to_server; content:"|30|"; depth:1; byte_test:1,>,120,1,relative; threshold:type both, track by_src, count 20, seconds 10; classtype:attempted-admin; reference:cve,2026-88165; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88165; sid:90088165; rev:1; metadata:affected_product Windows_AD_DS, attack_target Server, deployment Perimeter, signature_severity Major, created_at 2026_01_01;)

alert tcp any any -> any 636 (msg:"CVE-2026-88165 Potential AD DS Out-of-Bounds Write Exploitation Attempt (LDAPS)"; flow:established,to_server; content:"|16 03|"; depth:2; dsize:>400; threshold:type both, track by_src, count 20, seconds 10; classtype:attempted-admin; reference:cve,2026-88165; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88165; sid:90088166; rev:1; metadata:affected_product Windows_AD_DS, attack_target Server, deployment Perimeter, signature_severity Major, created_at 2026_01_01;)

Elastic Detection

sequence by host.id with maxspan=5m
  [ authentication where winlog.event_id == 4624 and
      winlog.event_data.LogonType in ("3", "8") and
      winlog.event_data.TargetUserName like "*$" ]
  [ process where winlog.event_id == 4688 and
      process.name in ("lsass.exe", "dns.exe") and
      process.parent.name in ("lsass.exe", "dns.exe", "services.exe") ]

Splunk SPL Query

index=windows (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:Directory-Service)
(EventCode=4624 Logon_Type=3 OR Logon_Type=8) OR (EventCode=1644 OR EventCode=131)
| stats count, values(Account_Name) AS accounts, dc(sourcetype) AS source_types
    by src_ip, dest, EventCode
| where count > 50
| eval risk = case(EventCode=1644, "LDAP query anomaly", EventCode=131, "NTDS write anomaly", true(), "auth+service pattern")
| sort - count
| table _time, src_ip, dest, EventCode, accounts, count, risk

(Companion correlation search — DC directory-service degradation:)

index=windows sourcetype=WinEventLog:Directory-Service (EventCode=1644 OR EventCode=131 OR EventCode=1539)
| stats count by host, EventCode
| where count > 25

Wazuh OSSEC Rule

<group name="windows,active_directory,cve-2026-88165,">
  <rule id="188165" level="12" frequency="5" timeframe="300">
    <if_matched_sid>60106</if_matched_sid>
    <match>Active Directory Domain Services</match>
    <description>CVE-2026-88165: Repeated suspicious authenticated AD DS access correlated with DC service activity - possible out-of-bounds write exploitation attempt</description>
    <mitre>
      <id>T1210</id>
    </mitre>
    <group>cve_2026_88165,attack_remote_exploitation,</group>
  </rule>

  <rule id="188166" level="10">
    <decoded_as>windows_eventchannel</decoded_as>
    <field name="win.system.eventID">^1644$</field>
    <description>CVE-2026-88165: Anomalous LDAP operation on domain controller - investigate for AD DS memory corruption</description>
    <mitre>
      <id>T1210</id>
    </mitre>
    <group>cve_2026_88165,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, fixed version, or workaround has been published in the available data. Until a vendor fix is released, mitigation is entirely preventive and compensating.

1) Immediate mitigations

• Treat domain controllers as tier-0 assets and enforce strict network segmentation so that only required administrative and replication endpoints can reach AD DS ports from untrusted or user-facing network segments.
• Restrict authenticated access to AD DS interfaces using host-based and network firewalls; allow only specific management subnets.
• Apply the principle of least privilege to service accounts and avoid credential reuse; a low-privileged account is the stated precondition, so reducing the number and reach of low-privileged accounts reduces exposure.
• Harden and monitor domain controller processes (LSASS and related directory services) with Credential Guard, LSA protection, and exploit-mitigation features (ASLR/DEP/CFG) where feasible, since these raise the difficulty of converting an out-of-bounds write into reliable code execution.
• Increase logging fidelity on domain controllers (Directory Service and Security channels) and alert on the detection rules above.

2) Patch / upgrade steps

• No patch exists as of this report. Monitor the Microsoft Security Response Center (MSRC) and the NVD entry for CVE-2026-88165 for an advisory, CVE-to-KB mapping, and affected version range.
• When a fix is published, prioritize domain controllers first, then member servers, and validate in a test domain before broad deployment.
• Because the affected version range is currently unknown, inventory all AD DS roles (DC, AD LDS, ADAM, and dependent services) and map them to vendor advisories as they are released.

3) Long-term hardening

• Adopt a tiered administration model to prevent low-privileged credentials from being usable against tier-0 services.
• Enforce network-level authentication and signing/channel binding for directory protocols where supported.
• Maintain continuous vulnerability management tied to MSRC advisories, and rehearse emergency domain-controller patching procedures.
• Deploy and tune the EQL/SPL/Sigma detections above so that anomalous authenticated directory-service activity is caught even without a known exploit signature.

References

1. NVD entry — CVE-2026-88165: https://nvd.nist.gov/vuln/detail/CVE-2026-88165
2. MITRE CWE-787 (Out-of-bounds Write): https://cwe.mitre.org/data/definitions/787.html
3. MITRE ATT&CK T1210 — Exploitation of Remote Services: https://attack.mitre.org/techniques/T1210/
4. Microsoft Security Response Center (MSRC) Security Update Guide (monitor for CVE-2026-88165 advisory): https://msrc.microsoft.com/update-guide
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-88165 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild evidence: None. No public proof-of-concept, exploit code, Nuclei template, or CISA KEV addition exists for CVE-2026-88165 in the available data. No named threat actor campaign is associated with this CVE at this time. EPSS has not yet scored this CVE. All exploitation scenarios in this report are inferred from the vulnerability class (CWE-787) and the published CVSS vector, not from observed activity.