Windows Active Directory Domain Services: Elevation of privilege

Summary

Microsoft Active Directory Domain Services (AD DS) on Windows domain controllers contains an incorrect authorization flaw (CWE-863) that allows an authenticated attacker to elevate privileges over the network. According to secondary analysis, exploitation requires winning a race condition. A successful attack could lead to SYSTEM on a domain controller and thus full control of the Windows domain. The attacker needs network access to a domain controller and any valid domain account; the flaw is not exposed to the internet.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)
• Note: the Windows Server entries are listed in the CVE record but could not be verified on the MSRC version table.

Fixed in

• Install the Microsoft security update of November 2026 (Patch Tuesday, 10 November 2026) for each affected OS; the update is listed with KB5131077 by secondary sources.
• Fixed builds: see the affected ranges above (first build after the 'before' value).
• Verify the KB and fixed build per OS on the MSRC page before rollout.

Workaround

Unknown.

Exploitation

• Not publicly disclosed before the patch was released.
• No evidence of exploitation in the wild found; not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof-of-concept found.
• Microsoft's exploitation outlook for this CVE is unclear in the sources; one source rates it 'More likely'.

Our recommendation

• Patch all domain controllers first, then other Windows systems with affected builds.
• Check your inventory for Windows 10 and Windows 11 clients and Windows Server domain controllers with affected builds.
• Restrict which accounts can log on to domain controllers and review privileged accounts.
• Monitor domain controllers for unusual privilege changes and authentication events until patched.
• Note the discrepancy: Microsoft rates this Critical, while the CVSS 3.1 score is 7.5 (High).

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Security Update Guide - MSRC CVE-2026-118148 msrc.microsoft.com
• CVE Record CVE-2026-118148 (CVE.org) www.cve.org
• Microsoft hotpatch baseline November 2026 (support.microsoft.com) support.microsoft.com
• CrowdStrike Patch Tuesday analysis November 2026 www.crowdstrike.com
• Trinetri Patch Tuesday November 2026 trinetriops.com
• CSO Online: November 2026 Patch Tuesday www.csoonline.com
• Rescana: Patch Tuesday November 2026 www.rescana.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:37.