CVE-2024-49112Windows LDAP critical remote-code-execution class flaw
What broke
CVE-2024-49112 is the critical Windows LDAP flaw that shipped next to LDAPNightmare. CVSS 9.8. Same December 2024 patch train. Public discussion has treated it as RCE-class on the LDAP stack.
Why it matters
A critical LDAP bug on a DC is a domain-compromise candidate, not a "directory availability" ticket. Take it with 49113, not after.
What to do
- Verify the December 2024 LDAP updates by KBN, not by "we patched that month."
- Keep LDAPS-only where you can, and do not let DCs chase LDAP referrals to untrusted hosts.
After you patch
Directory service flaws reach the system that answers "who is this" for everything else, so scope the response to the directory rather than the host.
- Review privileged group membership and delegation rights for changes during the exposure window.
- Rotate service account credentials used for directory binds, which are frequently stored in plaintext in application configuration. See service account.
- Check for newly created accounts and computer objects, the standard persistence step after directory access.
- Confirm LDAP signing and channel binding are enforced, since relay attacks against unsigned binds are the recurring follow-on. See lateral movement.
Sources
Related identity CVEs
Related on Start with Identity
- CVEHashiCorp Vault LDAP auth username enumeration
Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the
- CVEVault LDAP MFA enforcement bypass
Vault's LDAP auth method could be convinced to skip MFA enforcement. One of the VaultFault MFA-plane bugs. NVD CVSS was not confirmed at the time of the origina
- CVEVault TOTP and LDAP EntityID reuse
Vault reused EntityIDs across TOTP and LDAP in a way that let one identity land on another entity. Part of VaultFault. Confirm CVSS against NVD.
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- BlogGoogle Workspace puts FIDO2 keys into the Windows login, days after Entra makes passkeys default
Google began rolling out FIDO2 security keys as a second factor at Windows sign-in for all Workspace customers on 13 July. Microsoft is making passkeys the defa
- BlogMalware can drive a Windows Hello key for Entra ID persistence without a PIN prompt
Dirk-jan Mollema showed that code running in a signed-in Windows session can use the victim's TPM-bound Windows Hello for Business key as a FIDO2 credential, sa