Microsoft Active Directory Domain Services: Elevation of privilege

Summary

A weakness in Active Directory Domain Services (AD DS) allows an attacker with a valid low-privileged domain account to gain higher privileges over the network, according to the CNA record (CWE-1390, weak authentication). Per the CNA vector (CVSS 3.1 7.5, High), the attack complexity is high and the impact is high for confidentiality, integrity and availability. Domain controllers are the most sensitive systems affected. Vendor severity and prerequisites are not yet verified, and sources conflict on both.

Affected

• Per the CNA record: Windows 10 Version 1607, 1809, 21H2 and 22H2; Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2; Windows Server 2016, 2019 and 2022 (including Server Core installations)
• Affected builds according to the CNA record, below the fixed build. Windows Server 2019 and 2022 and the Windows 10 client builds are not confirmed by MSRC in our research and must be verified.

Fixed in

• Windows 10 1607 and Windows Server 2016: 10.0.14393.9688
• Windows 10 1809 and Windows Server 2019: 10.0.17763.9487
• Windows 10 21H2: 10.0.19044.7846
• Windows 10 22H2: 10.0.19045.7846
• Windows 11 23H2: 10.0.22631.7711
• Windows 11 24H2: 10.0.26100.9974
• Windows 11 25H2: 10.0.26200.9974
• Windows 11 26H1: 10.0.28000.3501
• Windows 11 26H2: 10.0.26300.9974
• Windows Server 2022: 10.0.20348.5870

Build numbers are the first fixed builds per the CNA record. Verify them against the MSRC advisory. The fix is in the November 2026 security update.

Workaround

Unknown. No Microsoft-published workaround was found. Check the mitigations and FAQ section of the MSRC advisory.

Exploitation

• No exploitation in the wild is known.
• No public proof-of-concept exploit found (VulDB).
• CISA SSVC: exploitation none, not automatable, total technical impact.
• ZDI reports a rating of "Exploitation More Likely" for this bug. This is unverified and must be checked against the MSRC exploitability field.
• The CNA vector requires low privileges and no user interaction. ZDI describes an unauthenticated attack scenario, which conflicts with the CNA vector. Treat the risk as potentially higher until resolved.

Our recommendation

• Obtain the MSRC advisory and confirm severity, CVSS vector, affected builds and mitigations.
• Install the November 2026 security update on all domain controllers first, then on all other affected Windows servers and clients.
• Until patched: review privileged and service accounts, limit unnecessary domain accounts, enforce strong passwords and MFA, and monitor domain controller security logs for unusual authentication activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (MSRC) msrc.microsoft.com
• CVE Record CVE-2026-118735 www.cve.org
• VulDB entry 435151 vuldb.com
• Strix CVE-2026-118735 (secondary, verify) www.strix.ai
• Zero Day Initiative November 2026 review www.zerodayinitiative.com
• Cybersecurity News: November 2026 Patch Tuesday cybersecuritynews.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:35.