---
id: "CVE-2026-118735"
page: "https://infrastack.ai/live/CVE-2026-118735"
kind: "vulnerability"
aliases: ["CVE-2026-118735"]
title: "Windows Active Directory Domain Services: weak authentication lets attacker gain privileges"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 10 1607", "fixed": ["10.0.14393.9688"], "affected": ">= 10.0.14393.0, < 10.0.14393.9688", "ecosystem": "microsoft"}, {"name": "Windows 10 1809", "fixed": ["10.0.17763.9487"], "affected": ">= 10.0.17763.0, < 10.0.17763.9487", "ecosystem": "microsoft"}, {"name": "Windows 10 21H2", "fixed": ["10.0.19044.7846"], "affected": ">= 10.0.19044.0, < 10.0.19044.7846", "ecosystem": "microsoft"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": ">= 10.0.19045.0, < 10.0.19045.7846", "ecosystem": "microsoft"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": ">= 10.0.22631.0, < 10.0.22631.7711", "ecosystem": "microsoft"}]
ecosystems: []
tags: ["active-directory", "domain-controller", "infrastructure", "on-prem", "self-hosted", "windows"]
not_affected_if: ["entra-only", "no-active-directory", "patched-nov-2026"]
published_at: "2026-11-10T19:19:50+00:00"
first_seen_at: "2026-11-10T19:24:55+00:00"
updated_at: "2026-11-10T23:00:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118735", "first_seen_at": "2026-11-10T19:24:55+00:00"}, {"source": "analyst", "url": "https://radar.offseq.com/threat/cve-2026-118735-cwe-1390-weak-authentication-in-microsoft-windows-10-version-1607-1823c22242dd948e", "first_seen_at": "2026-11-10T23:00:58+00:00", "cites": ["https://radar.offseq.com/threat/cve-2026-118735-cwe-1390-weak-authentication-in-microsoft-windows-10-version-1607-1823c22242dd948e"]}]
exploit_sources: []
---

# Windows Active Directory Domain Services: weak authentication lets attacker gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-118735 (this .md is for agents)

Active Directory Domain Services has weak authentication that lets an attacker who already holds a valid account elevate their privileges over the network. An attacker who gets this access could reach rights they should not have on the directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- microsoft:Windows 10 1607 affected >= 10.0.14393.0, < 10.0.14393.9688 fixed 10.0.14393.9688
- microsoft:Windows 10 1809 affected >= 10.0.17763.0, < 10.0.17763.9487 fixed 10.0.17763.9487
- microsoft:Windows 10 21H2 affected >= 10.0.19044.0, < 10.0.19044.7846 fixed 10.0.19044.7846
- microsoft:Windows 10 22H2 affected >= 10.0.19045.0, < 10.0.19045.7846 fixed 10.0.19045.7846
- microsoft:Windows 11 23H2 affected >= 10.0.22631.0, < 10.0.22631.7711 fixed 10.0.22631.7711

## How to check

On each domain controller (the role that runs AD DS), run winver or PowerShell (Get-ComputerInfo).OsBuildNumber / [System.Environment]::OSVersion and compare the full build (e.g. 10.0.17763.x) with the fixed builds; below the fixed build means exposed. Check the Server SKUs against the MSRC page for this CVE.

## Fix

Install the November 2026 (Patch Tuesday) Windows cumulative update. Fixed builds per the CVE record: Windows 10 1607 10.0.14393.9688, 1809 10.0.17763.9487, 21H2 10.0.19044.7846, 22H2 10.0.19045.7846, Windows 11 23H2 10.0.22631.7711 (8 more fixed builds, likely Server and other Windows 11 releases, not confirmed). Confirm the exact KB for your OS in the MSRC Security Update Guide.

## Timeline

- 2026-11-10T19:24:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118735
- 2026-11-10T23:00:58+00:00 analyst https://radar.offseq.com/threat/cve-2026-118735-cwe-1390-weak-authentication-in-microsoft-windows-10-version-1607-1823c22242dd948e — MSRC page is JS-only and unreadable here; NVD empty. Versions come from OffSeq's copy of the CVE record (secondary), so nothing marked verified. Fix is the Nov 2026 Patch Tuesday update. No exploitation or PoC found. ZDI lists a different AD DS EoP (CVE-2026-118148, Critical), a sibling and not this one.

## Documents

- [mentions] OffSeq Threat Radar: CVE-2026-118735 (rewrite of the CVE record) https://radar.offseq.com/threat/cve-2026-118735-cwe-1390-weak-authentication-in-microsoft-windows-10-version-1607-1823c22242dd948e

## From the sources

Weak authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_