Microsoft disclosed two Windows Active Directory vulnerabilities on November 10, 2026, exposing affected systems to remote code execution and denial of service. Tracked as CVE-2026-119948 and CVE-2026-105559, both carry an Important severity rating.
Their attack vectors require low privileges and no user interaction, highlighting the potential consequences of compromised accounts within enterprise environments. The disclosures accompany the November security updates, making remediation a priority for administrators responsible for Windows identity infrastructure.
Windows Active Directory RCE
CVE-2026-119948 stems from a stack-based buffer overflow, classified as CWE-121. According to the published CVE record, an authorized attacker can exploit the weakness to execute code over a network.
This memory corruption category involves writing beyond a stack buffer, potentially overwriting adjacent data or disrupting program execution. However, the disclosure does not identify the vulnerable function, affected protocol, or precise exploitation sequence.
The vulnerability has a CVSS v3.1 base score of 7.5 and a temporal score of 6.5. Its vector indicates high attack complexity, low privileges, unchanged scope, and high potential impacts on confidentiality, integrity, and availability.
These prerequisites distinguish it from an unauthenticated, readily exploitable network flaw. Nevertheless, successful exploitation could seriously compromise the affected component. Earlier reporting on an Active Directory remote execution flaw illustrates why authenticated attack paths remain relevant to enterprise defenders.
Affected products listed in the record include multiple Windows 10 and Windows 11 releases, as well as Windows Server 2016, 2019, 2022, and 2025. Server Core installations are explicitly listed for several server releases.
Administrators should match their precise operating system version and architecture against the published product entries rather than assuming that every Windows deployment shares identical exposure or remediation requirements.
CVE-2026-105559 is an untrusted pointer dereference vulnerability, categorized as CWE-822. The supplied advisory details assign it a CVSS v3.1 base score of 6.5 and a temporal score of 5.7.
Its network attack vector requires low privileges but has low attack complexity. Unlike the execution flaw, its stated impact concerns availability, with no direct confidentiality or integrity impact specified.
The lower complexity makes operational disruption an important consideration when prioritizing remediation. Although a separate vulnerability, prior coverage of an Active Directory Certificate Services denial-of-service issue highlights the operational importance of protecting directory infrastructure against availability attacks. Administrators should keep these components and vulnerabilities distinct when assessing exposure.
Security teams should review applicable November updates, verify successful installation, and prioritize affected identity infrastructure. Neither the supplied details nor the retrieved execution record establishes an active exploitation campaign; the unproven exploit maturity metric should not be interpreted as proof that exploitation is impossible.
Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs:
