Overview of CVE 2026 118146: Windows Active Directory Domain Services Incorrect Authorization Leading to Remote Code Execution

Introduction

Active Directory Domain Services sits at the center of authentication and access control in most Windows enterprise networks. A flaw there that lets an ordinary domain account run code on the directory server matters to every team that operates domain controllers. Microsoft patched CVE 2026 118146 in its November 10, 2026 Patch Tuesday release. It rated the issue Critical and assessed exploitation as More Likely. The CVE record gives a CVSS 3.1 base score of 8.8.

This post is a brief summary of what Microsoft and the CVE record disclose, what they leave out, and which builds contain the fix.

Technical information

Root cause

The assigned weakness is CWE 863, Incorrect Authorization. The CVE description is short: incorrect authorization in Active Directory Domain Services allows an authorized attacker to execute code over a network. Microsoft's advisory adds one detail. An authenticated, low-privileged attacker could send a specially crafted request to an affected server to execute code.

Most technical specifics are not public:

• Microsoft has not named a protocol, interface or request type.
• Windows is closed source, so no public diff, commit or code-level write-up exists.
• No proof of concept has been published.

Our reading of the CWE class and Microsoft's wording is that the fix probably adds or corrects a server-side authorization check in an AD DS request path, so that a low-privileged caller can no longer reach functionality reserved for more privileged principals. Microsoft has not published technical details of the change, so this remains an inference.

Microsoft Learn describes AD DS as the service that stores directory data and makes it available to network users and administrators. It also lists authentication and access control to directory objects as part of the AD DS security model. An authorization failure in that component affects the mechanism that other access decisions in the domain rely on.

CVSS breakdown

The CVE record and the MSRC advisory give this CVSS 3.1 vector:

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• AV:N: the attacker reaches the target over the network.
• AC:L: Microsoft considers the attack low complexity.
• PR:L: the attacker needs low privileges. This is not an unauthenticated bug.
• UI:N: no separate user action is needed.
• S:U: the impact stays within the vulnerable component's security scope.
• C:H / I:H / A:H: confidentiality, integrity and availability impacts are all rated high.

The base score is 8.8 (High), while Microsoft's own maximum severity rating is Critical. In practice, any valid low-privileged account becomes a possible starting point against a domain controller, and the code would run on a server that holds the directory.

Attack flow

The available sources support only a high-level sequence:

1. The attacker holds a valid, low-privileged identity (PR:L).
2. The attacker has network access to a server running the vulnerable AD DS code, in practice a domain controller (AV:N).
3. The attacker sends a specially crafted request to that server. No user interaction is needed (UI:N).
4. The faulty authorization logic accepts a request it should reject, and the attacker gets code execution on the server, with high impact to confidentiality, integrity and availability.

The sources do not say which protocol or port carries the request, or what security context the resulting code runs in. We have not filled in those gaps.

Exploitability and threat status

• Microsoft reports the issue was not publicly disclosed and not exploited at the time of publication.
• Microsoft rates exploitation as More Likely.
• Exploit code maturity is Unproven, which Microsoft defines as no publicly available exploit code or a theoretical exploit.
• CISA's November 10, 2026 announcement added six vulnerabilities to the Known Exploited Vulnerabilities catalog, and CVE 2026 118146 was not one of them. This only reflects that date and could change.
• No threat actor is named in the Microsoft advisory, the CVE record or the CISA announcement.

The More Likely rating is a reason to patch promptly, but it is not evidence that exploitation has occurred. Recheck the Microsoft and CISA sources if the threat status changes.

Patch information

Microsoft fixed CVE 2026 118146 in the November 10, 2026 Patch Tuesday release. The MSRC advisory sets the CVSS temporal Remediation Level to Official Fix, meaning Microsoft considers the vendor fix complete. The advisory lists no workaround or mitigation as an alternative to patching. We do not recommend disabling AD DS, changing network services or applying unverified workarounds.

How the fix ships

There is no standalone AD DS hotfix. The fix is part of the regular November 2026 cumulative security updates for each Windows branch. The MSRC Security Update Guide maps products to KB articles and fixed builds as follows:

• KB5131291: Windows Server 2016 (including Server Core), Windows 10 1607 (x86/x64). Fixed build 10.0.14393.9688.
• KB5131085: Windows Server 2019 (including Server Core), Windows 10 1809 (x86/x64). Fixed build 10.0.17763.9487.
• KB5131090: Windows Server 2022 (including Server Core). Fixed build 10.0.20348.5870.
• KB5131080 / KB5131077: Windows Server 2025 (including Server Core). Fixed builds 10.0.26100.33822 / 10.0.26100.33730.
• KB5131096: Windows 10 21H2 / 22H2 (x86, x64, ARM64). Fixed builds 10.0.19044.7846 / 10.0.19045.7846.
• KB5131087: Windows 11 23H2 (x64, ARM64). Fixed build 10.0.22631.7711.
• KB5132061 / KB5132043: Windows 11 24H2, 25H2, 26H2 (x64, ARM64). Fixed builds 10.0.26100.9974 / 10.0.26200.9974 / 10.0.26300.9974 for KB5132061; .9911 builds for KB5132043.
• KB5132059: Windows 11 26H1 (x64, ARM64). Fixed build 10.0.28000.3501.

Each KB is available from the Microsoft Update Catalog and can be deployed through Windows Update, WSUS or Intune.

Reading the build numbers

The CNA data on NVD gives each affected range as "below" a fixed build, for example 10.0.14393.0 < 10.0.14393.9688 for Server 2016 or 10.0.20348.0 < 10.0.20348.5870 for Server 2022. To verify a host, compare its OS build revision against the list above. A host at or above the listed build has the fixed code.

Windows Server 2025 and Windows 11 24H2/25H2/26H2 each have two KBs and two build numbers. NVD's affected range data uses the higher build as the cutoff: 26100.33822 for Server 2025 and x.9974 for Windows 11. The second, lower build probably belongs to a different servicing track that Microsoft ships for those branches. Check which channel your machines receive before marking them compliant.

What to patch first

The Windows 10 and Windows 11 client builds appear in the fix list because AD DS components ship in the shared OS servicing stack. The risk is concentrated on domain controllers, which run the AD DS role. Given the Exploitation More Likely rating, domain controllers should receive the update in the current maintenance window. On Server 2016, 2019 and 2022, one cumulative update per branch also covers Server Core installs.

Affected systems and versions

The CVE record lists builds below the following fixed versions as affected. Microsoft's advisory includes architecture-specific entries, so check the full product table for your exact SKU.

Windows Server

• Windows Server 2016 (including Server Core): builds from 10.0.14393.0 up to, but not including, 10.0.14393.9688
• Windows Server 2019 (including Server Core): builds below 10.0.17763.9487
• Windows Server 2022 (including Server Core): builds from 10.0.20348.0 up to, but not including, 10.0.20348.5870
• Windows Server 2025 (including Server Core): builds below 10.0.26100.33822

Windows 10

• Windows 10 version 1607 (x86/x64): builds below 10.0.14393.9688
• Windows 10 version 1809 (x86/x64): builds below 10.0.17763.9487
• Windows 10 version 21H2 (x86, x64, ARM64): builds below 10.0.19044.7846
• Windows 10 version 22H2 (x86, x64, ARM64): builds below 10.0.19045.7846

Windows 11

• Windows 11 version 23H2 (x64, ARM64): builds below 10.0.22631.7711
• Windows 11 version 24H2 (x64, ARM64): builds below 10.0.26100.9974
• Windows 11 version 25H2 (x64, ARM64): builds below 10.0.26200.9974
• Windows 11 version 26H1 (x64, ARM64): builds below 10.0.28000.3501
• Windows 11 version 26H2 (x64, ARM64): builds below 10.0.26300.9974

In practice, the vulnerable configuration that matters most is any of these server releases running the AD DS role as a domain controller.

References

• MSRC Security Update Guide: CVE 2026 118146
• NVD entry for CVE 2026 118146
• CVE Record for CVE 2026 118146
• Senserva CVE summary
• Tenable: Microsoft November 2026 Patch Tuesday
• Zero Day Initiative: The November 2026 Security Update Review
• CISA: Six Known Exploited Vulnerabilities Added to Catalog (November 10, 2026)
• Microsoft Learn: Active Directory Domain Services overview
• Microsoft Security Response Center mission
• Microsoft 2026 Annual Report