Windows Active Directory RCE Vulnerability Allows Attacker to Execute Code Over a Network

Microsoft has released security updates for a Windows Active Directory vulnerability that allows an authorized attacker to execute code over a network.

Tracked as CVE-2026-119948, the flaw was disclosed on November 10, 2026, and affects multiple Windows desktop and server versions. Microsoft rates it Important, with a CVSS 3.1 base score of 7.5.

The CVE record identifies the weakness as a stack-based buffer overflow. Exploitation requires low privileges and no user interaction, but the attack complexity is high. This means the flaw is not described as an unauthenticated attack that works against every reachable Windows system.

A stack-based buffer overflow occurs when a program writes more data to stack memory than is allocated for it. This can overwrite adjacent data and, under certain conditions, alter the program’s execution. In this instance, Microsoft confirms that the result may include the ability to execute remote code.

Microsoft has not disclosed the affected function, the exact network request needed, or a working attack method in the supplied advisory.

Its explanation of the high complexity rating says specific conditions must exist, such as particular protocol settings or configurations. Administrators should therefore avoid assuming that network access and valid credentials alone guarantee successful exploitation.

Windows Active Directory RCE Vulnerability

The CVSS assessment lists high potential impact on confidentiality, integrity, and availability. A successful attack could therefore affect protected information, change data, or disrupt the vulnerable system. However, the published record does not establish that exploitation automatically grants SYSTEM privileges or control of an entire domain.

At release, Microsoft reported no known exploitation and no prior public disclosure. It assessed exploitation as less likely and listed exploit code maturity as unproven. An anonymous researcher received credit for reporting the vulnerability.

The affected products include Windows Server 2016, 2019, 2022, and 2025, including listed Server Core installations. Windows 10 versions 1607, 1809, 21H2, and 22H2 are also included, alongside Windows 11 versions 23H2 through 26H2. Architecture coverage varies by release.

The supplied update list maps Windows Server 2022 to KB5131090, Server 2019 to KB5131085, and Server 2016 to KB5131291. Windows 11 version 23H2 uses KB5131087, while version 26H1 uses KB5132059. Administrators should check the package for each system rather than applying one update across all releases.

The disclosure follows earlier reporting on Active Directory security feature bypass vulnerabilities and a separate Active Directory Domain Services privilege escalation flaw. These are distinct issues, not evidence of an exploit chain involving the new RCE.

Microsoft also disclosed CVE-2026-105559, an Important Active Directory denial-of-service vulnerability with a 6.5 base score. The supplied advisory describes a network attack requiring low privileges, low complexity, and no user interaction.

Organizations should review both advisories, deploy the applicable official updates, and verify installation across affected systems.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Windows Active Directory RCE Vulnerability Allows Attacker to Execute Code Over a Network appeared first on Cyber Security News.