Windows Active Directory Domain Services Remote Code Execution Vulnerability
Plan PatchCVSS 8.8CVE-2026-88165Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
An out-of-bounds write vulnerability in Windows Active Directory Domain Services allows an authenticated attacker to execute code remotely over the network. The attacker must have valid domain credentials to exploit this issue. All supported versions of Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 are affected. Microsoft has released security updates for all affected platforms.
What this means
What could happen
An authenticated attacker with valid domain credentials could remotely execute arbitrary code on any Windows system or server running Active Directory Domain Services, potentially allowing them to take control of network resources and compromise the entire domain.
Who's at risk
Organizations running Windows domain environments should prioritize this vulnerability. It affects all supported versions of Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems that participate in or host Active Directory Domain Services. Any on-premises domain controller, member server, or workstation running affected Windows versions is at risk if domain credentials are compromised.
How it could be exploited
An attacker with valid domain user credentials sends a specially crafted network request to an Active Directory Domain Services endpoint. The out-of-bounds write vulnerability allows the attacker to overwrite memory and execute arbitrary code on the domain controller or networked Windows system running AD services.
Prerequisites
- Valid domain user credentials
- Network access to port 389 (LDAP) or port 636 (LDAPS)
- Target system running affected Windows version with Active Directory Domain Services enabled
remotely exploitablerequires valid credentialslow exploit complexityaffects core domain serviceshigh CVSS score (8.8)
Exploitability
Unlikely to be exploited — EPSS score 0.9%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/10
Do now
0/1WORKAROUNDRestrict LDAP network access (ports 389 and 636) to domain controllers at the firewall level, allowing only authorized management systems and domain-joined clients
Schedule — requires maintenance window
0/8Patching may require device reboot — plan for process interruption
Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later
All products
HOTFIXUpdate Windows 11 Version 26H2 (ARM64) to Build 10.0.26300.9711 or later
HOTFIXUpdate Windows 11 Version 26H2 (x64) to Build 10.0.26300.9711 or later
HOTFIXUpdate Windows 10 Version 1809 to Build 10.0.17763.9376 or later
HOTFIXUpdate Windows 10 Version 21H2 to Build 10.0.19044.7807 or later
HOTFIXUpdate Windows 10 Version 22H2 to Build 10.0.19045.7807 or later
Long-term hardening
0/1HARDENINGReview and enforce strong password policies and multi-factor authentication for domain user accounts to reduce the risk from compromised credentials
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/0713f9b8-0b7b-4205-a133-3dfa04ec7f87Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.