OTPulse

Windows Active Directory Domain Services Remote Code Execution Vulnerability

Plan PatchCVSS 8.1CVE-2026-70229Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary

Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.

What this means
What could happen
Could allow full system compromise — read data, modify settings, and disrupt operations
Who's at risk
Organizations in critical infrastructure using Microsoft equipment
How it could be exploited
Attacker on the corporate network or internet could reach this device without any credentials
Exploitability
Unlikely to be exploited — EPSS score 0.7%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 11 Version 26H2 for ARM64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 11 Version 26H2 for x64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 10 Version 1607 for 32-bit SystemsAll versionsBuild 10.0.14393.9612
Windows 10 Version 1607 for x64-based SystemsAll versionsBuild 10.0.14393.9612
Windows Server 2016All versionsBuild 10.0.14393.9612
Remediation & Mitigation
0/1
Long-term hardening
0/1
Exploitation assessment: Exploitation More Likely. Apply the 2026-Oct security update.
View full vendor advisory
API: /api/v1/advisories/c31d99a6-0087-45c9-bb44-176af4f9ab82

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.