Very likely, but also typically not exposed to the internet. So there's definitely plenty of risk here, but an adversary would likely have to be within your network to query your DC.
Yes, it's not a worm. That doesn't mean it's not a big deal for a lot of people, particularly if they've already had a minor compromise by someone waiting for this kind of exploit to escalate.