CVE-2026-65777

This vulnerability is a way to get around a built-in security guard in Windows Active Directory. If someone already has low-level access, they can use it over the network without needing anyone to click anything, potentially moving from a limited foothold to much more control. Think of it like having a key to a back door that should be locked, and finding a way to bypass that lock remotely.

This matters if your business uses Windows 11 or Windows Server 2022/2025 and those systems participate in a Windows Active Directory environment. The risk is primarily for attackers who already have low privileges (for example, a compromised account or account access inside your network). The attack does not require user interaction, so it’s focused on what’s reachable and where an attacker already has a foothold within your environment.

This is RED because exploitation has been reported as active in the wild. Microsoft released fixes in August 2026 Patch Tuesday, and the attacker path does not require user interaction, which increases real-world impact when a low-privileged attacker is present.

1. Inventory and scope

   • List all machines running Windows 11, Windows Server 2022, or Windows Server 2025.
   • Identify which of those are used with Windows Active Directory (domain-joined systems, directory-integrated services, or any role where Active Directory protections apply).

2. Check patch status

   • For each device, determine the OS build/version.
   • Determine whether the device is already at a fixed version included in the Microsoft August 2026 Patch Tuesday updates for CVE-2026-65777.

3. Upgrade to the fixed versions

   • Windows 11: ensure the system is fixed in one of the following versions:
     • 10.0.22631.7517
     • 10.0.26100.9106
     • 10.0.28000.2704
     • 10.0.26100.9168
     • 10.0.26200.9168
   • Windows Server 2022: ensure fixed in:
     • 10.0.20348.5440
     • 10.0.20348.5499
   • Windows Server 2025: ensure fixed in:
     • 10.0.26100.33222
     • 10.0.26100.33296

4. Temporary workaround (if patching is delayed)

   • The findings do not provide a reliable, specific workaround that eliminates the vulnerability. If you must delay patching, treat affected systems as high risk and prioritize patching over other changes.
   • In the meantime, reduce exposure by limiting who can obtain low-privilege access on systems that can reach Active Directory services.

5. Validate and monitor

   • After updates, confirm Windows Update shows the security update for CVE-2026-65777 is installed on all scoped systems.
   • Monitor for unusual authentication and privilege activity consistent with post-exploitation behavior on domain-connected systems, and ensure your incident response process is ready.

Severity is treated as high enough for a RED action path in this workflow due to reported active exploitation in the wild (incidents are described as actively exploited; patched in Microsoft’s August 2026 Patch Tuesday releases). The weakness is categorized as CWE-326 (inadequate encryption strength), and the mechanism described is a security feature bypass in Windows Active Directory driven by weak encryption over the network. The reported attacker model is an authorized low-privilege attacker with no user interaction required; this aligns with attacks that start from an existing foothold and then bypass protections to compromise system integrity. No public exploit code is listed in the findings, but exploitation activity is still reported as real-world. KEV is not listed in CISA KEV. EPSS is provided as a prediction in the findings, but real-world exploitation reporting takes precedence for urgency decisions.