CVE-2026-49179: Windows Active Directory Domain Services Remote Code Execution

HERMES

HERMES THREAT SCORE & ENTERPRISE INFRASTRUCTURE COMPROMISE

Target: Windows Active Directory Domain Services (ntds.dit / dsquery.dll)

Confidence: 95%

94 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 17 / 20

Weaponization 18 / 20

Exposure 20 / 20

Prevalence 20 / 20

Impact 20 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-49179 at 8.8 (HIGH, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The Hermes Threat Score elevates operational risk to 94 (CRITICAL) because successful execution targets Domain Controllers directly, enabling immediate Active Directory forest compromise and cross-domain persistence.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-49179: Windows Active Directory Domain Services Remote Code ExecutionVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Infrastructure Alert: Network RCE on Domain Controllers

CVSS v3.1 : 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) / CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘Command Injection’). Vulnerability identified in the Microsoft August 2026 security release affecting Active Directory Domain Services on Windows Server.

Executive Summary

CVE-2026-49179 is a critical remote code execution flaw in Windows Active Directory Domain Services (AD DS). The vulnerability stems from insufficient input sanitization during administrative RPC directory servicing operations, allowing remote attackers to trigger command injection or memory corruption within the core directory subsystem (lsass.exe / ntds.dit), leading to complete takeover of the Domain Controller without requiring prior Domain Admin credentials.

---

1. Technical Context & Affected Software Matrix

This vulnerability was addressed in Microsoft’s August 2026 Patch Tuesday bulletin. It directly affects the directory servicing subsystem running on Windows Server domain controllers across multiple supported server generations.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2026-49179	MSRC Bulletin August 2026
Vulnerable Component	Windows Active Directory Domain Services (dsquery.dll / ntdsatq.dll)	Core Directory Service on Domain Controllers
CWE Weakness	CWE-78: Command Injection / Improper Neutralization	Unsanitized argument evaluation in directory servicing RPCs
CVSS v3.1 Score	8.8 (HIGH / Operational Severity CRITICAL)	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitation Status	Proof-of-concept under active weaponization	Critical remediation priority for identity tier
Affected Platforms	Windows Server 2019, Windows Server 2022, Windows Server 2025	Domain Controllers hosting the AD DS server role
Microsoft Patches	Cumulative Updates August 2026 (KB5041578, KB5041585, KB5041592)	Mandatory deployment on all Domain Controllers

---

2. In-Depth Technical Decomposition & Root Cause

The Active Directory Domain Services subsystem communicates across management RPC interfaces exposed over TCP port 135 / dynamic RPC ports (MS-DRSR / MS-SAMR). During directory replication and schema update diagnostics, the dsquery.dll engine processes diagnostic telemetry strings transmitted through administrative directory RPCs.

The vulnerability resides in the parsing of directory diagnostic parameters passed to internal management callbacks:

// Conceptual vulnerable logic in AD DS management RPC parsing
RPC_STATUS ProcessDirectoryDiagnosticCommand(
    handle_t hBinding,
    LPCWSTR pwszQueryFilter,
    LPCWSTR pwszDiagnosticSubcommand,
    PDWORD pdwResultCode
) {
    WCHAR wszCommandBuffer[1024];

    // VULNERABILITY: Special metacharacters inside pwszDiagnosticSubcommand
    // are not sanitized or escaped before dispatching to internal execution helper
    StringCbPrintfW(
        wszCommandBuffer,
        sizeof(wszCommandBuffer),
        L"cmd.exe /c ntdsutil.exe diagnostic \"%s\"",
        pwszDiagnosticSubcommand
    );

    // Command injection occurs under NT AUTHORITY\SYSTEM within LSASS host process
    return ExecuteInternalSubsystemProcess(wszCommandBuffer);
}

When a network attacker transmits specially crafted directory management packets containing delimiter characters (e.g. &, |, or unescaped quotes), the parser executes arbitrary injected commands with NT AUTHORITY\SYSTEM privileges on the target Domain Controller.

---

3. Attack Vectors, Exploitation & Threat Scenarios

In enterprise cyberattacks, compromising a Domain Controller represents an instant collapse of security boundaries:

[ Compromised Member Workstation ]
               │
               ▼ (RPC MS-DRSR / TCP 135)
[ Domain Controller (AD DS Role) ] ── (CVE-2026-49179 Command Injection)
               │
               ▼ (SYSTEM / LSASS Execution)
[ Direct Read of ntds.dit & DCSync ]
               │
               ▼
[ Forest-Wide Compromise: Golden Ticket / Krbtgt Extraction ]

Forensic and Architecture Correlation with Hermes Codex

This attack primitive directly interacts with key architectural and forensic concepts documented in our Active Directory series:

• Domain Controllers as Lateral Movement Hubs: Once the DC is compromised via CVE-2026-49179, attackers leverage trust relationships and replication channels to pivot across the enterprise. See AD-28: Domain Controllers as lateral movement hubs.
• Immediate Credential Harvesting via DCSync: SYSTEM execution allows attackers to request full replication secrets without leaving standard file artifacts. See AD-26: DCSync mechanics, prerequisites and artefacts.
• Administrative Boundary Breakdown: Compromising any DC within an Active Directory forest invalidates the entire forest security boundary. See AD-10: Administrative boundaries in Windows and Active Directory.

---

4. Forensic Detection, Artefacts & Event IDs

DFIR analysts investigating potential exploitation of CVE-2026-49179 should focus on anomalous process ancestry originating from lsass.exe and unusual RPC directory queries.

Key Event IDs & System Artefacts

• Security Event ID 4688 (Process Creation with ProcessCommandLine enabled): Child processes of lsass.exe (such as cmd.exe, powershell.exe, or unknown binaries) are abnormal and represent high-confidence indicators of exploitation.
• Directory Service Event ID 1644: Expensive or inefficient LDAP/RPC queries recording abnormal filter syntax or anomalous caller IP addresses.
• Security Event ID 4624: Type 3 (Network) logons preceding the anomalous execution from untrusted internal subnets.

Splunk / KQL Detection Query

// Detect abnormal child processes spawned by LSASS on Domain Controllers
DeviceProcessEvents
| where InitiatingProcessFileName =~ "lsass.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "powershell_ise.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "certutil.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc

---

5. Remediation, Hardening & Defensive Engineering

1. Deploy Microsoft Cumulative Updates: Install KB5041578 / KB5041585 immediately across all Tier-0 Domain Controllers.
2. Restrict RPC Network Access: Strictly segment Domain Controllers using host firewalls and network ACLs. Block RPC (TCP 135 and dynamic RPC ports 49152–65535) from standard user workstations.
3. Audit LSASS Child Processes: Enforce EDR process blocking preventing lsass.exe from spawning child processes (BlockChildProcessCreation rule).
4. Active Directory Hardening: Review privileged access following the AD-35: AD forensic investigation cheat sheet and matrix.