CVE-2026-62785: Windows LDAP Service Remote Code Execution on Domain Controllers

HERMES

HERMES THREAT SCORE & CORE DIRECTORY ENGINE CODE EXECUTION

Target: Windows LDAP Subsystem (wldap32.dll / ntdsa.dll)

Confidence: 97%

96 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 18 / 20

Weaponization 18 / 20

Exposure 20 / 20

Prevalence 20 / 20

Impact 20 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-62785 at 8.8 (HIGH, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The Hermes Threat Score assigns 96 (CRITICAL) because LDAP ports (TCP 389/636/3268/3269) are universally open across enterprise networks, and successful execution grants direct SYSTEM control over Active Directory Domain Controllers.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-62785: Windows LDAP Service Remote Code Execution on Domain ControllersVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Domain Controller Alert: Network LDAP RCE

CVSS v3.1 : 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) / CWE-122: Heap-based Buffer Overflow. Patched in the August 2026 Microsoft security release affecting all Active Directory Domain Controllers running Windows Server.

Executive Summary

CVE-2026-62785 is a critical network-accessible remote code execution vulnerability in the Windows LDAP server implementation (ntdsa.dll). By transmitting specially malformed ASN.1 BER-encoded LDAP filter packets over TCP port 389 or 636, an unauthenticated network attacker triggers a heap buffer overflow in the directory parser. Successful exploitation yields remote code execution as NT AUTHORITY\SYSTEM, compromising the Domain Controller and the entire Active Directory domain.

---

1. Technical Context & Affected Software Matrix

The Windows LDAP service is built into every Active Directory Domain Controller, handling authentication, directory lookups, and global catalog queries.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2026-62785	MSRC Bulletin August 2026
Vulnerable Component	Windows LDAP Service (ntdsa.dll / esent.dll)	Active Directory Domain Services core directory listener
CWE Weakness	CWE-122: Heap-based Buffer Overflow	ASN.1 BER length mismatch during search filter decoding
CVSS v3.1 Score	8.8 (HIGH / Hermes Operational Severity 96)	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network Vector	TCP 389 (LDAP), TCP 636 (LDAPS), TCP 3268/3269 (Global Catalog)	Directly exposed to internal subnets and branch offices
Affected Platforms	Windows Server 2019, Windows Server 2022, Windows Server 2025	All Domain Controllers
Microsoft Patches	Cumulative Updates August 2026 (KB5041578, KB5041585, KB5041592)	Emergency remediation requirement

---

2. In-Depth Technical Decomposition & Root Cause

LDAP communications rely on Basic Encoding Rules (BER) to format search queries, bind requests, and directory updates. During the processing of complex nested search filters (such as multi-level (&(objectCategory=person)(|(mail=*)...))), ntdsa.dll recursively traverses BER elements.

When handling an ASN.1 sequence containing an indefinite-length constructed octet string nested within a recursive filter group, the length calculation integer arithmetic overflows:

// Conceptual depiction of CVE-2026-62785 BER decoder flaw
int DecodeLdapFilterElement(
    PBER_ELEMENT pBer,
    PDIR_FILTER_NODE pParentNode
) {
    ULONG ulLength = 0;
    ULONG ulTag = ber_get_tag_and_len(pBer, &ulLength);

    // VULNERABILITY: Integer arithmetic overflow in allocation calculation
    ULONG ulAllocSize = ulLength + sizeof(DIR_FILTER_NODE);
    if (ulAllocSize < ulLength) { // Incomplete validation check
        return LDAP_DECODING_ERROR;
    }

    PDIR_FILTER_NODE pNewNode = (PDIR_FILTER_NODE)LdapAlloc(ulAllocSize);

    // Copy assumes ulLength is bounded by packet envelope,
    // but fragmented BER payloads cause unbounded memcpy into smaller heap chunk
    memcpy(pNewNode->FilterData, pBer->pbCurrentPtr, ulLength);

    return LDAP_SUCCESS;
}

The heap corruption overwrites directory connection state structures, allowing weaponized ROP chains to execute within lsass.exe.

---

3. Attack Vectors & Enterprise Threat Scenarios

[ Internal Network Attacker / Rogue Workstation ]
               │
               ▼ (Crafted ASN.1 BER LDAP Request / TCP 389)
[ Active Directory Domain Controller ] ── (CVE-2026-62785 Heap Overflow)
               │
               ▼ (Arbitrary Code Execution as SYSTEM)
[ Direct Manipulation of Directory Database & Domain Secrets ]
               │
               ▼
[ Instant Domain Administrator & Forest Root Takeover ]

Forensic Correlation with Active Directory Corpus

• Domain Controllers as Lateral Movement Hubs: Exploiting LDAP provides direct entry to the central authority of the domain. See AD-28: Domain Controllers as lateral movement hubs.
• Directory Permissions and Access Control: Attackers gain the ability to grant DCSync rights (DS-Replication-Get-Changes-All) or manipulate ACLs on critical objects. See AD-08: NTFS permissions, share permissions and ACLs.
• NetExec and Reconnaissance Tools: NetExec leverages LDAP enumeration heavily. See AD-23: NetExec: what do the results actually prove?.

---

4. Forensic Detection, Artefacts & Event IDs

Investigating CVE-2026-62785 exploitation requires network traffic analysis and Windows Directory Service diagnostic logs:

Essential Artefacts & Event IDs

• Directory Service Event ID 1644: LDAP Search filter diagnostic events recording malformed filters or filters with extraordinary nesting depth.
• Directory Service Event ID 2886 & 2887: Unsigned LDAP connection events preceding the exploitation payload.
• Network Telemetry: Suricata / Zeek rules alerting on ASN.1 BER length anomalies in TCP 389/636 sessions.
• System Event ID 1000: Application crash events indicating unexpected termination of lsass.exe involving ntdsa.dll.

Suricata / Snort Detection Signature

# Conceptual Suricata rule for malformed LDAP BER filter
alert tcp any any -> $DOMAIN_CONTROLLERS [389,636,3268,3269] (
  msg:"HERMES - Possible CVE-2026-62785 Windows LDAP BER Heap Overflow Attempt";
  flow:to_server,established;
  content:"|30|"; depth:1;
  byte_test:4,>,65535,1;
  metadata:cve CVE-2026-62785, attack_target Domain_Controller;
  classtype:attempted-admin;
  sid:10002678;
  rev:1;
)

---

5. Remediation, Hardening & Defensive Engineering

1. Deploy August 2026 Security Updates: Apply KB5041578 / KB5041585 on all Domain Controllers.
2. Enforce LDAP Signing and Channel Binding: Set LDAPServerIntegrity=2 in HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters to reject unsigned LDAP traffic.
3. Restrict Network Exposure: Block direct LDAP access to Domain Controllers from general user workstations using microsegmentation or IPsec.