Loading story…
Microsoft confirmed that security update KB5087537 for Windows Server 2016 can break domain controller discovery on servers whose names are exactly the 15-character NetBIOS limit. After installing the May 2026 update, affected systems may return ERROR_INVALID_PARAMETER during DCLocator operations, including domain controller lookups performed by tools and applications, preventing systems from locating a domain controller and disrupting Active Directory-dependent functions such as authentication, Group Policy processing, and DFS Namespace administration.
Microsoft added the problem to the update’s known issues list and said it remains under investigation, with no fix timeline disclosed. Organizations running impacted domain controllers may need to use shorter hostnames or delay deployment of KB5087537 where possible until a corrective update is released. The issue adds to a broader history of Microsoft domain and Group Policy-related servicing and security problems, including the critical JASBUG flaw tracked as CVE-2015-0008, which allowed attackers on malicious networks to compromise domain-joined Windows systems through Group Policy and domain controller interactions.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft confirmed a known issue in KB5087537 on Windows Server 2016 where servers with 15-character hostnames can fail domain controller discovery, returning ERROR_INVALID_PARAMETER during DCLocator operations. The company added the problem to the update's known issues and said it was still investigating, with workarounds including shortening hostnames or delaying deployment.
Microsoft released the May 2026 Windows Server 2016 security update KB5087537. The update later proved to introduce a bug affecting domain controller discovery on some systems.
On Patch Tuesday, Microsoft released security bulletin MS15-011 (update 3000483) to fix the critical Group Policy remote code execution flaw CVE-2015-0008 affecting many supported Windows client and server versions. Microsoft said exploitation could let attackers fully compromise domain-joined systems on attacker-controlled networks, while Windows Server 2003 would not receive a patch.
JAS Advisors and simMachines privately reported the Active Directory/Group Policy design flaw later nicknamed Jasbug to Microsoft in January 2014. Microsoft began working on a fix for what it described as a core Windows design problem.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcetechnet.microsoft.com
Open sourceics-cert.us-cert.gov
Open sourcethenextweb.com
Open sourcetheregister.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft said the Windows security update `KB5082063` can cause some Windows domain controllers to enter continuous reboot loops after `LSASS` crashes during startup. The issue affects non-Global Catalog domain controllers in environments using Privileged Access Management, disrupting Active Directory authentication and directory services and potentially making affected domains unavailable. Impacted platforms include Windows Server 2016, 2019, 2022, 23H2, and 2025, while consumer systems and devices outside IT-managed domains are not affected. Microsoft has not yet released a fix and is advising affected organizations to contact Microsoft Support for Business for mitigation guidance. The company also acknowledged two other known issues tied to `KB5082063`: installation failures on some Windows Server 2025 systems and BitLocker recovery key prompts on some Windows Server 2025 devices. The incident adds to a string of recent Windows Server update problems that have affected domain controllers and authentication services in enterprise environments.
Jun 29, 2026
Microsoft is investigating reports that the Windows 11 cumulative security update **KB5124008** can break Active Directory domain trust relationships after affected enterprise endpoints restart. On Windows 11 24H2 and 25H2 systems, the issue reportedly disrupts the machine-account secure channel with domain controllers, preventing valid domain users from signing in; cached offline credentials may remain usable. Administrator reports link the failures to **Machine Identity Isolation** operating in enforcement mode, although Microsoft has not confirmed the root cause, added the problem to its known-issues documentation, or released an official workaround. Organizations should limit deployment, preserve local administrator or LAPS recovery access, and test remediation carefully; reported options include uninstalling the update, repairing or resetting the machine-account password, or rejoining systems to the domain, while disabling Machine Identity Isolation may reduce security protections or itself affect authentication.
Sep 17, 2026
Semperis disclosed two Active Directory privilege-escalation vulnerabilities involving hidden and unfilterable Unicode characters that can undermine Microsoft’s identity protections. The first flaw, **KerberLoss** (`CVE-2026-25177`), lets a low-privileged user with service principal name (SPN) write permissions bypass SPN and SPN-alias uniqueness checks, enabling denial of service against `HOST`-mapped services, SPN-jacking in constrained delegation scenarios, and forced Kerberos-to-NTLM downgrade. The second flaw, **ResetNightmare** (`CVE-2026-27912`), is more severe and allows an attacker who can write a user principal name (UPN) on a user or computer object to abuse NT-ENTERPRISE name handling and the Kerberos password-change protocol to reset a privileged account’s password and gain Domain Admin access. The findings build on Microsoft’s earlier hardening work for `CVE-2021-42282`, which introduced uniqueness verification for UPNs, SPNs, and SPN aliases, but the new research shows those checks could still be bypassed under certain conditions. Microsoft patched **KerberLoss** in March 2026 and **ResetNightmare** in April 2026. Defenders were urged to update domain controllers, restrict delegated rights that allow SPN or UPN modification, and monitor Active Directory changes—particularly suspicious SPN and UPN edits such as **Event ID 5136**—for signs of exploitation.
Aug 6, 2026