Windows AD RCE CVE-2026-119948, per Cyber Security News report

What happened

According to Cyber Security News, Microsoft has released security updates for a Windows Active Directory vulnerability, tracked as CVE-2026-119948, that allows an authorized attacker to execute code over a network. The outlet says the flaw was disclosed on November 10, 2026. This advisory relies on that single outlet’s account of Microsoft’s advisory. We did not review the Microsoft advisory or the NVD record directly, so every detail below is as reported by Cyber Security News.

Cyber Security News reports that:

• Microsoft rates the flaw Important with a CVSS 3.1 base score of 7.5. The severity label in this file’s front matter is set conservatively because the only source is a single news outlet, not an official record; it is not a downgrade of Microsoft’s rating.
• The CVE record identifies the weakness as a stack-based buffer overflow.
• Exploitation requires low privileges and no user interaction, but attack complexity is high.
• Microsoft’s explanation of the high complexity says specific conditions must exist, such as particular protocol settings or configurations.
• The CVSS assessment lists high impact on confidentiality, integrity and availability. The outlet adds that the published record does not establish that exploitation automatically grants SYSTEM privileges or control of an entire domain.
• At release, Microsoft reported no known exploitation and no prior public disclosure. It assessed exploitation as less likely and exploit code maturity as unproven.
• An anonymous researcher received credit for reporting it.

Not confirmed: the affected function, the exact network request needed, and any working attack method. Cyber Security News says Microsoft did not disclose them in the advisory it reviewed.

The outlet also reports that Microsoft disclosed CVE-2026-105559, an Important Active Directory denial-of-service vulnerability with a 6.5 base score. It describes this as a network attack requiring low privileges, low complexity and no user interaction.

Cyber Security News also refers to earlier reporting on Active Directory security feature bypass vulnerabilities and a separate Active Directory Domain Services privilege escalation flaw. It says these are distinct issues from CVE-2026-119948, not evidence of an exploit chain involving it. The outlet does not make that statement about CVE-2026-105559.

Am I affected?

Per Cyber Security News, the affected products include:

• Windows Server 2016, 2019, 2022 and 2025, including listed Server Core installations.
• Windows 10 versions 1607, 1809, 21H2 and 22H2.
• Windows 11 versions 23H2 through 26H2.

Architecture coverage varies by release. Whether a given system is exploitable depends on conditions such as protocol settings or configuration, which the source does not detail. Not confirmed: which specific configurations are vulnerable.

What to do now

1. Inventory the Windows Server and Windows 10 or 11 systems listed above, including Server Core installations.
2. Pick the update for each release rather than one package for all. Cyber Security News maps these examples: Server 2022 to KB5131090 (build 10.0.20348.5870), Server 2019 to KB5131085 (10.0.17763.9487), Server 2016 to KB5131291 (10.0.14393.9688), Windows 11 23H2 to KB5131087 (10.0.22631.7711), and Windows 11 26H1 to KB5132059 (10.0.28000.3501). The outlet’s table also lists KBs for Server 2025, Windows 11 24H2, 25H2 and 26H2, and Windows 10 releases.
3. Install the official updates and verify the resulting build number on each system.
4. Review both the CVE-2026-119948 and CVE-2026-105559 advisories, as the outlet recommends.
5. Confirm details against Microsoft’s own advisory and the NVD records, since this summary rests on one news report.

Sources

• Cyber Security News: Windows Active Directory RCE Vulnerability Allows Attacker to Execute Code Over a Network