Microsoft Patches Critical Active Directory Remote Code Execution Flaw

Microsoft released a fix for CVE-2026-118146, an incorrect-authorization vulnerability in Windows Active Directory Domain Services that allows an authenticated attacker with low privileges to execute code remotely. An attacker can exploit the flaw by sending a specially crafted network request to an affected server, without user interaction. Microsoft rates the vulnerability Critical; its CVSS v3.1 score is 8.8 (High), reflecting potentially severe impacts on confidentiality, integrity, and availability.

Microsoft assesses exploitation as more likely, but reported no known exploitation or prior public disclosure when it published the advisory on November 10. The CVE record lists affected Windows 10, Windows 11, and Windows Server releases with build-specific boundaries. Organizations should identify affected systems against Microsoft's product and build listings and prioritize the available security updates, particularly for servers providing Active Directory services.