Windows Active Directory RCE Vulnerability Allows Attacker to Execute Code Over a Network
Microsoft has released security updates for CVE-2026-119948, a stack-based buffer overflow vulnerability in Windows Active Directory that allows authenticated attackers to execute code remotely.
Microsoft has issued security updates to address CVE-2026-119948, a critical vulnerability affecting Windows Active Directory that permits an authenticated attacker to execute code remotely over a network. The flaw, disclosed on November 10, 2026, is classified as Important by Microsoft, carrying a CVSS 3.1 base score of 7.5.
The vulnerability is characterized as a stack-based buffer overflow. While exploitation requires low privileges and no user interaction, the attack complexity is rated as high. This indicates that successful exploitation is contingent upon specific conditions, such as particular protocol settings or configurations, rather than being a straightforward attack against any accessible system.
A stack-based buffer overflow occurs when a program attempts to write more data into a buffer allocated on the stack than it can hold. This can lead to the overwriting of adjacent memory regions, potentially altering the program's execution flow and, in this case, enabling remote code execution.
The CVSS assessment highlights a high potential impact on confidentiality, integrity, and availability, meaning a successful exploit could compromise sensitive data, alter system information, or disrupt services. However, the advisory does not specify if exploitation grants SYSTEM privileges or complete domain control.
At the time of its disclosure, Microsoft reported no known exploitation of CVE-2026-119948 and no prior public disclosure of the vulnerability. The company assessed the likelihood of exploitation as less probable, with exploit code maturity rated as unproven. An anonymous researcher was credited with reporting the flaw.
The vulnerability impacts a wide range of Windows Server and desktop versions. Affected server products include Windows Server 2016, 2019, 2022, and 2025, along with their Server Core installations. For Windows desktop users, the flaw affects Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2 through 26H2.
Microsoft has provided specific KB updates for each affected system. Administrators are advised to consult the provided advisory for the precise KB numbers applicable to their specific Windows versions and installations, as a single update may not cover all releases. This includes updates such as KB5131090 for Windows Server 2022 and KB5131087 for Windows 11 version 23H2.
In addition to CVE-2026-119948, Microsoft also disclosed CVE-2026-105559, an Important Active Directory denial-of-service vulnerability. Organizations are urged to review both advisories, deploy the necessary official updates promptly, and verify their successful installation across all vulnerable systems to mitigate potential risks.