LDAP identity CVEs
LDAP is how almost every on-prem identity integration still binds. A crash or RCE on the DC LDAP stack is an authentication outage, then a domain-compromise candidate.
How this protocol fails
LDAPNightmare and its critical sibling (December 2024) showed that a crafted LDAP response can take a domain controller down, and worse. Public PoCs kept this in the 2025 defender window. Vault and Okta LDAP auth methods also failed lockout, MFA, and enumeration checks. The protocol is old. The bind is still load-bearing.
What security people should do
- Confirm the December 2024 Windows LDAP updates on every DC and management jump box.
- Restrict which hosts a DC will chase for referrals. Prefer LDAPS.
- If Vault or Okta delegates to LDAP, take those product CVEs in the same change. Enumeration plus lockout bypass is a brute-force pair.
CVEs in this category
Showing 2 of 2
- CVE-2024-49113highLDAPNightmare, domain-controller DoS via crafted LDAP responseWindows LDAP client · Microsoft · 2024-12-10 · Patched
A crafted LDAP response crashes the Windows LDAP client and can take a domain controller down. SafeBreach published a PoC in January 2025. High. Patched December 2024. Pair with CVE-2024-49112.
- CVE-2024-49112critical 9.8Windows LDAP critical remote-code-execution class flawWindows LDAP · Microsoft · 2024-12-10 · Patched
The critical sibling of LDAPNightmare. CVSS 9.8. Patched with CVE-2024-49113 in December 2024. If you only took the DoS patch, check the build.