Vulnerability Analysis

CVE-2026-33826: Windows Active Directory RPC RCE — What It Is & How to Fix It

Executive Summary

CVE-2026-33826 is a high-severity remote code execution (RCE) vulnerability in the Windows Active Directory RPC service, patched by Microsoft on April 14, 2026 as part of Patch Tuesday. An authenticated attacker with access to the same Active Directory domain can send specially crafted RPC calls to a vulnerable domain controller, resulting in code execution with the permissions of the RPC host process. Microsoft rates this vulnerability as "Exploitation More Likely," making rapid patching critical before a functional public exploit emerges.

1. What Is This Vulnerability?

CVE-2026-33826 is caused by improper input validation (CWE-20) in the Remote Procedure Call (RPC) service that underpins Windows Active Directory. Specifically, a particular sequence of malformed RPC packets can trigger a memory corruption condition in the AD processing layer that leads to arbitrary code execution on the target host.

Active Directory relies heavily on RPC for replication, authentication, and administrative communication between domain controllers and member machines. Because this channel is inherently trusted within a domain, any exploitable flaw in its input handling carries outsized enterprise risk.

Attack Vector

The attack flow looks like this:

  1. Attacker gains an authenticated foothold within the Active Directory domain (via phishing, credential stuffing, lateral movement, etc.)
  2. Attacker crafts a malformed RPC request targeting the vulnerable Active Directory service endpoint (typically over TCP port 135 / dynamic RPC ports)
  3. The AD service fails to properly validate the malformed input, triggering a memory corruption condition
  4. Attacker achieves code execution with the permissions of the RPC host process — which on a domain controller runs with high privilege

Because the attack vector is adjacent network (AV:A in CVSS terms) and requires low privilege and no user interaction, a single compromised domain user account is sufficient to attempt exploitation.

Real-World Impact

While no confirmed in-the-wild exploitation has been reported as of April 20, 2026, Microsoft's "Exploitation More Likely" rating means functional exploit code is anticipated within 30 days. Domain controllers are among the highest-value targets in any enterprise network — full compromise of a DC effectively means full compromise of the entire Windows environment, including all user accounts, credentials, Group Policy, and connected systems.

2. Who Is Affected?

The following Windows Server versions hosting Active Directory Domain Services are vulnerable:

Product Patch KB
Windows Server 2025 KB5082063
Windows Server 2022 KB5082142
Windows Server 2019 KB5082151
Windows Server 2016 KB5082153
Windows Server 2012 R2 KB5082285

Scope: Any organization running Windows Active Directory — covering the vast majority of enterprise environments — is potentially affected. Read-only domain controllers (RODCs) and standard member servers that do not host AD DS are not directly vulnerable, but may be affected by a compromised DC.

Prerequisite: The attacker must already have authenticated access to the AD domain. This lowers the bar significantly in environments with many domain accounts, and makes the vulnerability particularly dangerous in breach scenarios where credentials have been phished or leaked.

3. How to Detect It (Testing)

Manual Testing Steps

  1. Identify exposed RPC endpoints on domain controllers. Run the following from a domain-joined Windows host:

    rpcdump.exe /s <DC-IP-Address>

    Review the output for unexpected or anonymous RPC interfaces. Any DC that still exposes the vulnerable AD interface (pre-patch) will show the relevant GUID in the endpoint list.

  2. Check patch status. On the domain controller, verify the presence of the relevant KB:

    Get-HotFix | Where-Object { $_.HotFixID -match "KB5082063|KB5082142|KB5082151|KB5082153|KB5082285" }

    If the relevant KB is absent, the system is unpatched.

  3. Review Event Logs for anomalous RPC activity. Open Event Viewer and filter the System and Security logs for:

    • Event ID 5145 (network share access) indicating unusual RPC pipe activity (\PIPE\lsass)
    • Event ID 4625 (failed logon) combined with rapid RPC connection attempts (may indicate exploit probing)

Automated Scanning

  • Tool: Tenable Nessus / Tenable.sc

    • Plugin: Search for plugin referencing CVE-2026-33826; Tenable released detection checks shortly after Patch Tuesday
    • Command: Run a credentialed scan against domain controllers
    • Expected output: Flagged finding if KB is missing on any DC

  • Tool: Microsoft Security Compliance Toolkit / MBSA

    • Run against domain controllers to enumerate missing patches
    • Expected output: Report listing unpatched DCs

  • Tool: CrowdStrike Falcon / Defender for Endpoint

    • Query for missing patches in the vulnerability management dashboard
    • Filter by CVE-2026-33826 to enumerate exposed endpoints

Code Review Checklist

For organizations running custom AD integration or in-house tooling that uses RPC:

  • Verify all RPC input is validated against expected length and type constraints before processing
  • Confirm RPC endpoints enforce authenticated sessions (not anonymous RPC)
  • Check that RPC servers on DCs run under least-privilege service accounts, not SYSTEM
  • Ensure firewall rules restrict RPC port 135 and dynamic ports to authorized subnets only

4. How to Fix It (Mitigation)

Step-by-Step Remediation

  1. Apply the April 2026 Patch Tuesday updates immediately. Prioritize domain controllers above all other systems. Download the appropriate KB for each DC version from the Microsoft Update Catalog.

  2. Reboot domain controllers after patching. RPC service patches typically require a restart to take full effect. Plan a maintenance window and stagger DC reboots to maintain domain availability.

  3. Verify patch installation on every DC. Use the PowerShell command above (or SCCM/Intune compliance reporting) to confirm every domain controller has the KB installed. Do not assume automatic updates have run.

  4. Implement RPC firewall hardening as a defense-in-depth layer (see Configuration Hardening below). This will not replace patching but reduces exposure while patching is staged.

  5. Audit domain accounts for minimum privilege. Since exploitation requires authentication, reducing the number of accounts with unnecessary domain access lowers the risk from compromised credentials.

Configuration Hardening

Block external access to RPC on domain controllers via Windows Firewall:

# Block inbound RPC (TCP 135) from non-DC subnets
New-NetFirewallRule -DisplayName "Block RPC from untrusted subnets" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 135 `
  -RemoteAddress <untrusted-subnet-CIDR> `
  -Action Block

# Restrict dynamic RPC port range to a known range
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Rpc\Internet" `
  -Name "PortsInternetAvailable" -Value "Y"
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Rpc\Internet" `
  -Name "UseInternetPorts" -Value "Y"
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Rpc\Internet" `
  -Name "Ports" -Value "49152-49200"

Enable RPC authentication enforcement via Group Policy:

Navigate to: Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options

  • Enable: Network access: Restrict clients allowed to make remote calls to SAM
  • Enable: Network security: Restrict NTLM: Audit incoming NTLM traffic (set to Enable auditing for all accounts)

Restrict RPC access to authorized hosts only:

Use Active Directory–integrated firewall policies to ensure only authorized management workstations and peer DCs can reach port 135 on domain controllers.

5. How to Test the Fix (Validation)

Regression Test Scenarios

  • Scenario A: After patching, re-run the Tenable Nessus or equivalent credentialed scan against all DCs — CVE-2026-33826 findings should no longer appear.
  • Scenario B: Confirm normal AD replication is functioning post-patch by running repadmin /replsummary on each DC; any errors indicate an issue with the patch rollout.
  • Scenario C: Verify standard domain authentication is not broken — confirm user logins, Group Policy application, and Kerberos ticket issuance are operating normally after reboot.

Security Test Cases

Test Case 1: Verify vulnerability no longer exists

  • Precondition: KB patch applied and DC rebooted
  • Steps: Run credentialed vulnerability scan targeting domain controllers for CVE-2026-33826
  • Expected Result: No findings for CVE-2026-33826; scan returns clean result

Test Case 2: Confirm RPC port restrictions are in effect

  • Precondition: Firewall hardening rules applied
  • Steps: From a non-authorized subnet, attempt rpcdump.exe /s <DC-IP> or a port scan against TCP 135
  • Expected Result: Connection refused / filtered; no RPC endpoint enumeration possible from untrusted segments

Test Case 3: Confirm domain functionality is intact

  • Precondition: All DCs patched and rebooted
  • Steps: Perform end-to-end AD health check (dcdiag /test:all on each DC)
  • Expected Result: All tests pass; no replication failures or service errors

Automated Tests

# Quick patch validation script — run on each DC
$requiredKBs = @("KB5082063","KB5082142","KB5082151","KB5082153","KB5082285")
$installedKBs = Get-HotFix | Select-Object -ExpandProperty HotFixID
$found = $requiredKBs | Where-Object { $installedKBs -contains $_ }

if ($found) {
    Write-Host "PASS: Relevant Patch Tuesday KB found: $($found -join ', ')" -ForegroundColor Green
} else {
    Write-Host "FAIL: No April 2026 Patch Tuesday KB detected on this system. Patch immediately." -ForegroundColor Red
}

6. Prevention & Hardening

Best Practices

  • Patch domain controllers on an accelerated cadence. DCs should receive Patch Tuesday updates within 24–72 hours of release, prioritizing any vulnerability rated Critical or High with "Exploitation More Likely."
  • Enforce least-privilege domain accounts. Every additional domain account that doesn't need privilege is a potential attacker foothold. Audit group memberships — especially Domain Users, Domain Admins, and any service accounts with broad permissions.
  • Segment domain controllers from workstation subnets. DCs should only be reachable on necessary ports from authorized admin hosts and peer DCs. Use Windows Firewall GPOs and network-level ACLs to enforce this.
  • Enable Credential Guard and Protected Users Security Group to harden high-value accounts against pass-the-hash / pass-the-ticket attacks that could give an attacker the domain foothold needed for this exploit.
  • Implement tiered administration (Microsoft's AD Tier Model): admin accounts used to manage DCs should never be used on workstations, reducing the chance of credential theft leading to a DC attack.

Monitoring & Detection

Monitor for the following indicators of potential exploitation attempts:

  • Unusual RPC connections to DCs from non-admin workstations. Alert on any host other than authorized admin machines or peer DCs making RPC connections (TCP 135 / dynamic ports) to domain controllers.
  • Anomalous AD replication events. Watch for unexpected repadmin errors, NTDS replication failures, or new replication partnerships (Event IDs 1311, 1864, 2087 in Directory Service log).
  • High-frequency RPC bind failures. A burst of RPC connection attempts from a single host — especially with varying or malformed parameters — may indicate automated exploit probing. Correlate with Sysmon Event ID 3 (network connections) for process-level visibility.
  • Event ID 4648 (logon with explicit credentials) on DCs from unexpected sources. This can indicate lateral movement or an attacker attempting to authenticate to services on the DC.

A Sigma detection rule for suspicious RPC activity targeting DCs:

title: Suspicious RPC Connection to Domain Controller
id: cve-2026-33826-rpc-detect
status: experimental
description: Detects high-frequency RPC connections to domain controllers from non-standard sources
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName: '\PIPE\*'
    SubjectUserName|not|endswith: '$'
  filter_admin:
    IpAddress: '<authorized-admin-subnets>'
  condition: selection and not filter_admin
falsepositives:
  - Legitimate admin tools using named pipes
level: medium
tags:
  - attack.lateral_movement
  - cve.2026.33826

References

Latest from the blog

See all →