CVE-2026-32157
As of 2026-05-07, CVE-2026-32157 is a CVSS 9 (CRITICAL-severity) vulnerability. EPSS exploitation probability 0.1%. Threadlinqs Intelligence tracks 2 threats exploiting it.
Last updated: 2026-05-07
CVE-2026-32157 is a critical remote code execution vulnerability in Microsoft Active Directory Domain Services, disclosed as part of the April 2026 Patch Tuesday addressing 167 vulnerabilities. An authenticated attacker with low privileges can write arbitrary LDAP attributes leading to domain controller code execution (CVSS 9.0). This vulnerability is part of a massive patch release that includes two zero-days (CVE-2026-32201 SharePoint spoofing actively exploited, CVE-2026-33825 Defender EoP publicly disclosed), a wormable Windows TCP/IP IPv6 RCE (CVE-2026-23666, CVSS 9.8), and six additional Critical RCE flaws across Word, .NET, Remote Desktop, IKE Extensions, Office/Outlook, and SharePoint Server. The AD DS vulnerability is particularly dangerous in enterprise environments as it enables direct compromise of domain controllers from any authenticated domain user.
CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Weaknesses (CWE)
CWE-20
Threats tracking this CVE
- Microsoft April 2026 Patch Tuesday — 163 CVEs / 88 Advisories (CVE-2026-32201 SharePoint Zero-Day Exploited In-The-Wild, CVE-2026-33825 Defender EoP Public PoC, CVE-2026-33824 IKE RCE CVSS 9.8, CVE-2026-33827 TCP/IP Wormable RCE) — CRITICAL
- Microsoft April 2026 Patch Tuesday — 167 Flaws, 2 Zero-Days (SharePoint Spoofing CVE-2026-32201 + Defender EoP CVE-2026-33825) — CRITICAL
References
← all vulnerabilities · Markdown version · Threadlinqs Intelligence
Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.