{"id":"CVE-2026-118146","kind":"vulnerability","aliases":["CVE-2026-118146"],"related":[],"title":"Windows Active Directory Domain Services: incorrect authorization lets a low-privileged user run code over the network","description":"Incorrect authorization in Active Directory Domain Services allows an authorized attacker to execute code over a network.","summary":"Incorrect authorization (CWE-863) in Active Directory Domain Services lets an authenticated, low-privileged attacker execute code over the network. Microsoft rates it CVSS 8.8, fixed in the November 2026 Patch Tuesday updates. No exploitation or public PoC known at publication; Microsoft assesses Exploitation More Likely.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["active-directory","domain-controller","infrastructure","on-prem","windows","windows-server"],"not_affected_if":["no-on-prem-ad","patched-nov-2026","unknown"],"how_to_check":"On each domain controller run winver, or in PowerShell: (Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion') and read CurrentBuildNumber and UBR. Compare with the fixed build for your Windows version; a lower build is exposed.","fix":"Install the November 2026 cumulative update: Server 2016 10.0.14393.9688, Server 2019 10.0.17763.9487, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822. Windows 10/11 client builds are also listed by Microsoft (Win10 22H2 10.0.19045.7846, Win11 24H2 10.0.26100.9974). Patch domain controllers first.","status":"open","published_at":"2026-11-10T19:19:34+00:00","first_seen_at":"2026-11-10T19:24:49+00:00","triaged_at":"2026-11-10T19:30:17+00:00","updated_at":"2026-11-10T23:23:41+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-10T19:30:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Active Directory Domain Services: authorization flaw lets an attacker run code","impact":"high","summary":"Active Directory Domain Services has an incorrect authorization check that lets an authorized attacker execute code over the network. The sources give no further detail on the affected versions or the exact trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["active-directory","windows-server","domain-controller"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker with valid access runs code over the network","analyst_note":"Find the Microsoft advisory for CVE-2026-118146 to confirm affected Windows Server versions, the fixed builds and any mitigation.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Active Directory Domain Services on Windows Server domain controllers. The sources do not name affected versions or the specific configuration that makes a system exposed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000655,"input_tokens":4486,"output_tokens":413,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-118146 to confirm affected Windows Server versions, the fixed builds and any mitigation.","search":"'-118146':21A,24A '-2026':20A,23A '-863':54B '2016':27A '2019':30A '2022':33A '2025':36A '2026':81B '8.8':76B 'activ':2A,38B,56B,101C 'active-directori':37B 'allow':105C 'assess':94B 'attack':66B,108C 'authent':62B 'author':7A,52B,99C,107C 'code':15A,68B,111C 'control':42B 'cve':19A,22A 'cvss':75B 'cwe':53B 'directori':3A,39B,57B,102C 'domain':4A,41B,58B,103C 'domain-control':40B 'execut':67B,110C 'exploit':86B,95B 'fix':77B 'incorrect':6A,51B,98C 'infrastructur':43B 'known':90B 'let':8A,60B 'like':97B 'low':11A,64B 'low-privileg':10A,63B 'microsoft':72B,93B 'network':18A,71B,114C 'novemb':80B 'on-prem':44B 'patch':82B 'poc':89B 'prem':46B 'privileg':12A,65B 'public':88B,92B 'rate':73B 'run':14A 'server':26A,29A,32A,35A,50B 'servic':5A,59B,104C 'tuesday':83B 'updat':84B 'user':13A 'window':1A,47B,49B 'windows':25A,28A,31A,34A 'windows-serv':48B","nicknames":[],"mitigations":[],"who_affected":"Organisations running Active Directory with domain controllers on Windows Server 2016, 2019, 2022 or 2025 that are below the November 2026 fixed builds. An attacker needs a valid low-privileged domain account and network reach to the DC. Cloud-only Entra ID setups with no on-premises domain controllers can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T23:23:41Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-118146","run_id":3160},"products":{"at":"2026-11-10T23:23:41Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-118146","run_id":3160}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["server2016","server2019","server2022","server2025","windowsserver2016","windowsserver2019","windowsserver2022","windowsserver2025"],"ptokens":["2016","2019","2022","2025","server","windows"],"labels":["activedirectory","domaincontroller","high","infrastructure","onprem","windows","windowsserver"],"campaign_type":null,"search_a":"'-118146':21A,24A '-2026':20A,23A '2016':27A '2019':30A '2022':33A '2025':36A 'activ':2A 'author':7A 'code':15A 'cve':19A,22A 'directori':3A 'domain':4A 'incorrect':6A 'let':8A 'low':11A 'low-privileg':10A 'network':18A 'privileg':12A 'run':14A 'server':26A,29A,32A,35A 'servic':5A 'user':13A 'window':1A 'windows':25A,28A,31A,34A","search_b":"'-863':54B '2026':81B '8.8':76B 'activ':38B,56B 'active-directori':37B 'assess':94B 'attack':66B 'authent':62B 'author':52B 'code':68B 'control':42B 'cvss':75B 'cwe':53B 'directori':39B,57B 'domain':41B,58B 'domain-control':40B 'execut':67B 'exploit':86B,95B 'fix':77B 'incorrect':51B 'infrastructur':43B 'known':90B 'let':60B 'like':97B 'low':64B 'low-privileg':63B 'microsoft':72B,93B 'network':71B 'novemb':80B 'on-prem':44B 'patch':82B 'poc':89B 'prem':46B 'privileg':65B 'public':88B,92B 'rate':73B 'server':50B 'servic':59B 'tuesday':83B 'updat':84B 'window':47B,49B 'windows-serv':48B","search_c":"'activ':101C 'allow':105C 'attack':108C 'author':99C,107C 'code':111C 'directori':102C 'domain':103C 'execut':110C 'incorrect':98C 'network':114C 'servic':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118146","severity":null,"published_at":"2026-11-10T19:19:34+00:00","modified_at":"2026-11-10T19:19:35+00:00","first_seen_at":"2026-11-10T19:24:49+00:00","fetched_at":"2026-11-10T19:24:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118146:3160","url":"https://cveawg.mitre.org/api/cve/CVE-2026-118146","severity":null,"published_at":"2026-11-10T23:23:41+00:00","modified_at":"2026-11-10T23:23:41+00:00","first_seen_at":"2026-11-10T23:23:41+00:00","fetched_at":"2026-11-10T23:23:41+00:00","note":"Read Microsoft CNA CVE record (MSRC page itself did not load); builds from it. Not exploited, no PoC found (CISA SSVC: exploitation none; MS: Exploitation More Likely).","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-118146","https://www.lansweeper.com/blog/patch-tuesday/microsoft-patch-tuesday-November-2026/"]}],"documents":[{"id":120127,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-118146","title":"CVE-2026-118146 CVE record (Microsoft CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":120129,"url":"https://www.lansweeper.com/blog/patch-tuesday/microsoft-patch-tuesday-November-2026/","title":"Lansweeper: Patch Tuesday November 2026","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}