Microsoft patches Windows Active Directory RCE and denial-of-service flaws

November 10 updates fix two Important Active Directory flaws; Microsoft reports no known exploitation.

Microsoft released November 10, 2026 updates for two Important Windows Active Directory vulnerabilities. CVE-2026-119948 is a stack-based buffer overflow scored CVSS 3.1 7.5 that an authorized attacker can use for code execution over a network when specific configurations exist. Attack complexity is high, privileges are low, and no user interaction is required. Microsoft says exploitation is not known and exploit code is unproven. The same disclosure covers CVE-2026-105559, an untrusted-pointer-dereference denial-of-service issue scored 6.5.