Microsoft discloses Active Directory remote code execution and denial-of-service flaws
Original title: Windows Active Directory RCE and DoS Vulnerabilities Put Windows Systems at Risk
Both Important-rated flaws need low privileges; the record does not show an active exploitation campaign.
Microsoft disclosed CVE-2026-119948 and CVE-2026-105559 on November 10, 2026, with the November security updates. CVE-2026-119948 is a stack-based buffer overflow that an authorized attacker can use for network code execution. CVE-2026-105559 is an untrusted pointer dereference whose stated impact is availability. Affected entries include Windows 10, Windows 11, and Windows Server 2016, 2019, 2022, and 2025, including some Server Core installs.
Unconfirmed: The supplied details do not establish active exploitation, and exploit maturity is unproven.
- CVE-2026-119948 has a CVSS v3.1 base score of 7.5 and temporal score of 6.5.
- The execution flaw has high attack complexity, low privileges, and no user interaction.
- CVE-2026-105559 scores 6.5 base and 5.7 temporal, with low attack complexity.
- The disclosure does not name the vulnerable function, protocol, or exploit sequence.
- Administrators should match exact OS version and architecture to published entries.
Impact: Authenticated network code execution or denial of service
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Windows Active Directory | Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 | November security updates |
- 1.Review and verify installation of the applicable November updates.
- 2.Prioritize remediation on affected Windows identity infrastructure.
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-119948+1 related CVE | Stack buffer overflow in Windows Active Directory | 7.5 group max | — |
From the original article
2 min read at gbhackers.com
Microsoft disclosed two Windows Active Directory vulnerabilities on November 10, 2026, exposing affected systems to remote code execution and denial of service. Tracked as CVE-2026-119948 and CVE-2026-105559, both carry an Important severity rating. Their attack vectors require low privileges and no user interaction, highlighting the potential consequences of compromised accounts within enterprise environments.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.