Microsoft Active Directory Domain Services Vulnerability Allows Attackers to Escalate Privileges

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft AD DS Vulnerability CVE-2026-25177 Allows Privilege Escalation On March 10, 2026, Microsoft released a critical security update addressing a high-severity vulnerability in Active Directory Domain Services (AD DS), tracked as CVE-2026-25177. This flaw, with a CVSS score of 8.8, enables authorized network attackers to escalate their privileges to full SYSTEM control. The vulnerability arises from improper restrictions on file access, potentially impacting organizations that rely on AD DS for identity and access management. As of the publication of this information, the vulnerability is considered serious due to its potential for exploitation in enterprise environments. Users are urged to apply the security update immediately to mitigate risks. The flaw affects various versions of Microsoft Windows Server that utilize AD DS. No active exploitation has been reported yet, but the severity of the vulnerability warrants prompt action. Organizations should prioritize patching to prevent potential attacks. 4 sources 74