Microsoft Patches Active Directory Remote Code Execution and Denial-of-Service Flaws

Microsoft released security updates for two Windows Active Directory vulnerabilities that allow authenticated, low-privileged attackers to execute code or disrupt availability over a network without user interaction. CVE-2026-119948, rated Important with a CVSS 3.1 score of 7.5, is a stack-based buffer overflow that can severely affect confidentiality, integrity, and availability. Exploitation has high attack complexity and requires specific environmental or configuration conditions; the advisory does not establish automatic SYSTEM privileges or domain-wide compromise. Multiple Windows desktop and server releases are affected.

The separate CVE-2026-105559 denial-of-service vulnerability is rated Important with a CVSS score of 6.5. It requires low attack complexity and can cause high availability loss, without assessed confidentiality or integrity impact. At disclosure, Microsoft reported neither vulnerability as publicly disclosed or exploited and assessed exploitation of both as less likely. Organizations should identify affected Windows systems, apply the release-specific fixes for both vulnerabilities, and verify successful installation.