Microsoft discloses Active Directory remote code execution and denial-of-service flaws
Both Important-rated flaws need low privileges; the record does not show an active exploitation campaign.
62
CVE-2026-105559
Denial of service in Windows Active Directory (authenticated)
- CVSS 3.1
- 6.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A flaw in Windows Active Directory lets an attacker who already has low privileges deny service over the network. No user interaction is required. Impact is limited to availability; confidentiality and integrity are not affected. Microsoft has not listed affected builds or a fixed version.
What to do: Microsoft has not listed a fixed version or workaround for CVE-2026-105559.
| Product | Affected |
|---|---|
| Microsoft Windows Active Directory | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
No cwe for this issue in Windows Active Directory allows an authorized attacker to deny service over a network.
- Weakness
- CWE-822
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
In the news
2 storiesMicrosoft patches Active Directory network RCE rated Important
CVE-2026-119948 is a CVSS 7.5 stack overflow needing low privileges; Microsoft reports no known exploitation.
62