74 openlast updated

HomeOctober 2026 patch cycleOctober DC updates vs NetApp ONTAP: LDAP says your credentials are invalid

Known issueEnterprisefrom 2026-10

Issue from: October 2026 Patch Tuesday: 1,413 fixes, one exploited zero-day, and an Exchange hangover

October DC updates vs NetApp ONTAP: LDAP says your credentials are invalid

Part of October 2026 patch cycle

Vendor
Microsoft
Products
Windows Server 2016-2025 domain controllers, NetApp ONTAP 9.x, and Netwrix Activity Monitor
Published
Status
Open

Call: Known issue. Patch your domain controllers, but check your third-party LDAP clients first. NetApp has a set of KB articles tying “LDAP Invalid Credentials” on ONTAP to the October 2026 domain controller updates. Netwrix says the same updates stop its Activity Monitor from collecting some AD events. AskWoody also lists “Windows Server: LDAP failures on older systems” among this month’s business issues. Don’t skip the October updates over this: they include a fix for an actively exploited Windows Shell flaw (see the October roundup).

Which updates: KB5126646 (Windows Server 2025), KB5126655 (2022), KB5126651 (2019) and KB5126868 (2016), all released Oct 13. NetApp and Netwrix list the same four.

What breaks:

  • NetApp ONTAP 9.x. SVMs that bind to Active Directory LDAP with session-security-for-ad-ldap set to none start getting “Invalid credentials” from patched DCs. NetApp tracks it as CONTAP-821088.
  • Netwrix Activity Monitor (AD module). On patched DCs it stops capturing some events: LDAP Bind on 2025, LDAP Bind and Kerberos on 2022, all three (LDAP Bind, Kerberos, NTLM) on 2019, and Kerberos and NTLM on 2016. Netwrix says the DCs themselves stay stable.

Workaround:

  • ONTAP: set session-security-for-ad-ldap to sign or seal. NetApp says either one satisfies the CONTAP-821088 workaround; pick based on how much you want the LDAP traffic protected (seal encrypts it).
  • Netwrix: Netwrix’s notice says to delay the KBs if you rely on those event types, until it ships an updated AD module. We’d rather patch the DCs and accept an audit gap for a few days than leave an exploited bug open, but that’s your auditors’ call, not ours.
  • Everyone else: if you have other appliances that bind to AD over unsigned LDAP, test one against a patched DC before you roll the rest. Signing your LDAP was always the plan anyway. The plan has now arrived.

Sources: NetApp: which KBs, NetApp: sign or seal, NetApp: LDAP servers unavailable, Netwrix notice, AskWoody MS-DEFCON 4.

Sources

More from October 2026 patch cycle