CVE-2026-70229

CVE-2026-70229 is an incorrect-authorization flaw (CWE-863) in Microsoft Active Directory Domain Services. A remote, unauthenticated attacker can exploit it over the network without user interaction, though Microsoft rates attack complexity as high (CVSS 3.1 base score 8.1). Successful exploitation can lead to code execution with high impact on confidentiality, integrity, and availability of the affected domain controller, with unchanged scope. It affects organizations that run Active Directory Domain Services; exact product builds are not stated in the source data and are covered by the October 2026 Microsoft updates. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Install Microsoft's October 2026 security updates on every domain controller that runs Active Directory Domain Services, then confirm the update applied. Until patching is complete, keep domain controllers off the internet, restrict which networks can reach AD protocols, and watch for unexpected remote code execution or privilege changes.