CVE-2026-69524 CVE-2026-69546 Active Directory RCE: Patch Checks

Summary: CVE-2026-69524 CVE-2026-69546 Active Directory RCE

CVE-2026-69524 and CVE-2026-69546 are separate remote code execution vulnerabilities in Active Directory Domain Services (AD DS), published on September 8, 2026. Both have a CVSS 3.1 base score of 8.1, require no privileges or user interaction in their CVSS vectors, and involve a use-after-free weakness. Microsoft says successful exploitation depends on winning a race condition. That additional difficulty should inform patch scheduling, without removing either vulnerability from the domain-controller remediation queue. These are September updates being reviewed in October, not newly announced October flaws. Microsoft's September CVRF is the source for the CVE facts below.

For defenders, the immediate priorities are to match every domain controller to its applicable update, verify installation and restart completion, and preserve useful telemetry. The public CVRF does not supply a CVE-specific event signature or indicator of compromise. Generic directory-change or service-health alerts should support investigation without being presented as proof that either flaw was exploited.

CVE-2026-69524 and CVE-2026-69546 Side by Side

The following values come from the September CVRF retrieved on October 3, 2026. Microsoft labels both vulnerabilities Important. The exploitation strings are reproduced exactly; their different likelihood assessments must remain distinct.

Neither CVE was present in the CISA Known Exploited Vulnerabilities JSON catalogue checked on October 3, 2026; the retrieved catalogue version was 2026.10.02. Absence on that date and Microsoft's Exploited:No fields are separate observations. Neither guarantees that exploitation cannot occur or that all activity has been observed.

How It Works: Use-After-Free and a Race Condition

A use-after-free occurs when software accesses memory after that memory has been released. Its consequences depend on the implementation; crashes and unauthorized execution are among the possibilities described in MITRE's CWE-416 definition. This explains the weakness class, without establishing the vulnerable function or precise packet format for either CVE.

Microsoft's FAQ for CVE-2026-69524 describes an unauthenticated attacker sending a crafted packet to an affected network service. Its FAQ for CVE-2026-69546 describes an attacker within the network invoking arbitrary endpoints. Both FAQs say that exploitation needs a race condition to be won. The CVRF does not identify the affected endpoints, a reliable exploit sequence, or a shared underlying code defect. Grouping the vulnerabilities here reflects their common component, weakness class, and update mapping.

Why AC:H Still Requires Action

AC:H identifies an additional exploitation obstacle. It does not change PR:N into an authentication requirement or UI:N into a requirement for someone to click a link. Our operational recommendation is to prioritize affected domain controllers because they serve the identity infrastructure, while retaining Microsoft's actual likelihood assessments. Avoid inventing a success rate, calling these flaws wormable, or assuming that network access means public Internet exposure.

The August domain-controller RCE review explains why teams inventory DC-related roles and verify patch compliance across them. It covers a different release and different CVEs; its attack descriptions should not be transferred to this pair.

Verify the Correct Update on Each Domain Controller

The September CVRF maps both CVEs to these Windows Server remediations, including the corresponding Server Core products. This table records the original update mapping, not an instruction to install an older package over a newer applicable cumulative update.

Match the product and installation variant before choosing an update. Inclusion in this CVRF table is not a statement about a server's support entitlement. For Server 2025, the KB5122871 support article independently confirms OS build 26100.33438 and describes the supported installation channels. Consult the applicable release documentation for prerequisites, known issues, and later updates.

Microsoft's Get-HotFix documentation gives this exact local inventory command:

Get-HotFix

Its documented -Id and -ComputerName parameters can be applied to the Server 2025 mapping as follows. DC01 is a placeholder; use the actual controller name. These commands are documentation-based examples, not results obtained from a customer environment.

Get-HotFix -Id KB5122871 -ComputerName DC01

Retain the returned installation evidence together with the exact OS version, running build, and restart status from your management tooling. Get-HotFix uses the Win32_QuickFixEngineering class, whose update coverage is limited. A missing entry needs investigation; it does not by itself establish vulnerability, particularly when a later update supersedes the original KB. Confirm applicability and supersedence before closing the record.

Detection: Collect Context, Then Investigate

Separate missing-patch exposure from suspected compromise. The former needs trustworthy update inventory. The latter needs correlated activity and investigation. No event ID below uniquely identifies exploitation of CVE-2026-69524 or CVE-2026-69546.

Microsoft documents AD DS diagnostic logging, including its default collection of critical and error events. Raise diagnostic verbosity only for a bounded investigation and return it to the normal setting afterward; increased detail can affect performance. Forward the Security and Directory Service logs centrally and check ingestion health before relying on their absence.

The primary event references are 5136: directory object modified and 1102: audit log cleared. For 5136, preserve SubjectUserName, ObjectDN, AttributeLDAPDisplayName, AttributeValue, OperationType, and OpCorrelationID. A change typically produces separate value-deletion and value-addition events; correlate them using OpCorrelationID and the object and attribute context to compare old and new values. The AD monitoring guide explains why audit policy, collection, field mapping, and correlation must work together before event-based detections provide useful coverage.

For local triage, this example adapts Microsoft's Get-WinEvent syntax and hashtable filtering. Run it on the controller with appropriate log-reading rights:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5136,1102} -MaxEvents 100
Get-WinEvent -LogName 'Directory Service' -MaxEvents 100

The limit bounds the displayed records; it is not an alert threshold or a complete incident timeline. Review the relevant time window in your SIEM, correlate unexpected changes with host and network telemetry, and exclude documented maintenance. A quiet query cannot certify that a DC is patched or uncompromised.

Remediation: Patch, Restart, and Preserve Evidence

1. Create a controller-by-controller update record. Include the exact Windows Server product, installation variant, applicable KB or superseding update, owner, and completion evidence. Resolve unreachable or unreported systems explicitly.
2. Deploy the applicable supported update. Both CVEs require customer action. Use the approved update channel and the release's prerequisites and known-issue guidance. For Server 2025, the support article recommends the latest applicable Windows update and records later resolution of an RDS issue affecting the September release.
3. Complete the required restart and validate service health. Both CVRF entries mark restart required for the listed Server updates. Confirm authentication and replication through your normal operational checks, and compare new directory-service errors against the pre-maintenance baseline.
4. Recheck installation evidence. Use the documented inventory command and management records, confirm the running build and supersedence, and retain the result for every controller. A deployed package with an outstanding restart is not a completed change record.
5. Investigate credible compromise separately. Preserve centrally collected logs and host evidence, coordinate containment with the identity incident-response team, and assess unauthorized directory changes. Installing the fix alone does not reverse changes an attacker may already have made.

How EtcSec Detects This

Use EtcSec configuration audit findings alongside independent patch-compliance records and SIEM investigation. This review does not validate an EtcSec check for either CVE, its installed update, or its exploitation. A configuration finding alone cannot establish whether a controller has received the applicable September AD DS update.