CVE-2024-49112Windows LDAP critical remote-code-execution class flaw
What broke
CVE-2024-49112 is the critical Windows LDAP flaw that shipped next to LDAPNightmare. CVSS 9.8. Same December 2024 patch train. Public discussion has treated it as RCE-class on the LDAP stack.
Why it matters
A critical LDAP bug on a DC is a domain-compromise candidate, not a "directory availability" ticket. Take it with 49113, not after.
What to do
- Verify the December 2024 LDAP updates by KBN, not by "we patched that month."
- Keep LDAPS-only where you can, and do not let DCs chase LDAP referrals to untrusted hosts.
After you patch
Directory service flaws reach the system that answers "who is this" for everything else, so scope the response to the directory rather than the host.
- Review privileged group membership and delegation rights for changes during the exposure window.
- Rotate service account credentials used for directory binds, which are frequently stored in plaintext in application configuration. See service account.
- Check for newly created accounts and computer objects, the standard persistence step after directory access.
- Confirm LDAP signing and channel binding are enforced, since relay attacks against unsigned binds are the recurring follow-on. See lateral movement.
Sources
Related identity CVEs
Related on Start with Identity
- CVEFreeIPA anonymous LDAP write plants a Kerberos principal in the admins group
FreeIPA's self-managed OTP token ACI let an anonymous LDAP client create a token entry with extra attributes, which combined with a 389 Directory Server ACI fla
- CVEHashiCorp Vault LDAP auth username enumeration
Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the
- CVEVault TOTP and LDAP EntityID reuse
Vault reused EntityIDs across TOTP and LDAP in a way that let one identity land on another entity. Part of VaultFault. Confirm CVSS against NVD.
- GlossaryActive Directory
Microsoft's on-premises directory service, providing authentication, authorization, group policy, and a hierarchical store of users, computers, and groups for a
- GlossaryDirectory Service
A directory service is the system that stores an organization's identities and their attributes (users, groups, devices, service accounts) in one queryable data
- GlossaryRADIUS
RADIUS (Remote Authentication Dial-In User Service) is a protocol, defined in [RFC 2865](https://www.rfc-editor.org/info/rfc2865/), that network devices such as