Skip to navigation

Threat reportVulnerabilityTL-2026-5739

Windows Active Directory RCE Vulnerability (CVE-2026-119948) Allows Code Execution Over a Network

highPATCHED

CVE-2026-119948 is a stack-based buffer overflow (CWE-121) in Windows Active Directory that lets an authorized, low-privileged attacker execute code over a network (CVSS 3.1 7.5, Important; attack complexity high). Microsoft released per-product security updates on 2026-11-10 and reported no known exploitation and no prior public disclosure.

Key facts

IdentifiersTL-2026-5739, CVE-2026-119948, CVE-2026-105559
SeverityHIGH
CVSS7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
First disclosed
Affected productsMicrosoft Windows Server; Microsoft Windows 11; Microsoft Windows 10
Weaknesses (CWE)CWE-121, CWE-822
MalwareWindows10
MITRE ATT&CK techniquesT1078 Valid Accounts, T1210 Exploitation of Remote Services, T1499 Endpoint Denial of Service, T1499.004 Endpoint Denial of Service: Application or System Exploitation, T1587.004 Develop Capabilities: Exploits
MotivationUNKNOWN
Target sectorsgovernment administration, finance, health, technology, enterprise
Target regionsGlobal
Detection rules9 (1 shown free)
Sources5 cited sources

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5739 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-119948 AD Stack Overflow Indicator - lsass.exe Fault in AD Modules / NTDS Service Termination (Splunk)

Behaviour-first detection for exploitation attempts against the CVE-2026-119948 stack-based buffer overflow (CWE-121) in Windows Active Directory, and for the related CVE-2026-105559 AD denial-of-service. A failed or high-complexity memory-corruption attempt against the directory service typically surfaces on a domain controller as an Application Error (EventID 1000) for lsass.exe with a stack-overrun/access-violation exception (0xc0000409 / 0xc0000005) or a fault module of ntdsai.dll/ntdsa.dll, or as an unexpected termination of the Active Directory Domain Services service (Service Control Manager 7031/7034). Microsoft reports no known exploitation and has not published the trigger, so this is a crash-and-instability indicator, not a signature of a specific exploit. Patched systems carry KB5131080, KB5131077, KB5131090, KB5131085, KB5131291, KB5132061, KB5132043, KB5132059, KB5131087 or KB5131096.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1210, T1499, T1499.004
  • Data sources: windows_application_log, windows_system_log, wineventlog
  • Severity: high
  • Confidence: medium

Splunk SPL

index=wineventlog ((sourcetype="WinEventLog:Application" SourceName="Application Error" EventCode=1000 Message="*lsass.exe*" (Message="*c0000409*" OR Message="*c0000005*" OR Message="*ntdsai.dll*" OR Message="*ntdsa.dll*")) OR (sourcetype="WinEventLog:System" SourceName="Service Control Manager" (EventCode=7031 OR EventCode=7034) Message="*Active Directory Domain Services*")) | eval signal=if(sourcetype="WinEventLog:Application","lsass_fault_in_AD_module","ntds_service_terminated") | stats count min(_time) as first_seen max(_time) as last_seen values(signal) as signals by host | convert ctime(first_seen) ctime(last_seen) | table host signals count first_seen last_seen

Microsoft KQL

Event
| where TimeGenerated > ago(24h)
| where (EventLog == 'Application' and Source == 'Application Error' and EventID == 1000
    and RenderedDescription has 'lsass.exe'
    and RenderedDescription has_any ('c0000409', 'c0000005', 'ntdsai.dll', 'ntdsa.dll'))
    or (EventLog == 'System' and Source == 'Service Control Manager' and EventID in (7031, 7034)
    and RenderedDescription has 'Active Directory Domain Services')
| project TimeGenerated, Computer, EventLog, Source, EventID, RenderedDescription

Sigma

title: Lsass.exe Fault in Active Directory Modules on Domain Controller - CVE-2026-119948
id: 7c1f2a54-3b8e-4d6a-9a1e-5f0c2b7d8e11
status: experimental
description: Detects an Application Error (EventID 1000) for lsass.exe with a stack-overrun or access-violation exception code or an Active Directory fault module. This can indicate a failed memory-corruption attempt against the CVE-2026-119948 Active Directory stack-based buffer overflow or the related CVE-2026-105559 denial of service.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119948
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105559
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.lateral-movement
    - attack.t1210
    - attack.impact
    - attack.t1499
    - attack.t1499.004
    - cve.2026-119948
    - cve.2026-105559
logsource:
    product: windows
    service: application
detection:
    selection_app:
        Provider_Name: 'Application Error'
        EventID: 1000
        Data|contains: 'lsass.exe'
    selection_fault:
        Data|contains:
            - 'c0000409'
            - 'c0000005'
            - 'ntdsai.dll'
            - 'ntdsa.dll'
    condition: selection_app and selection_fault
falsepositives:
    - Faulty third-party authentication or password-filter DLLs loaded into lsass.exe
    - Memory or hardware faults on a domain controller
level: high

Known false positives:

  • Third-party password filters, authentication packages or security agents that crash lsass.exe on a domain controller
  • Hardware or memory faults, or an administrator stopping Active Directory Domain Services during maintenance or patching

Tuning notes: Scope to domain controllers by host and suppress hosts in approved patch windows (the CVE-2026-119948 updates reboot DCs). Correlate hits with SPL-003 (authenticated network logon bursts from one source) and KQL-001 (forced DC restart) to raise confidence, and confirm the affected build against the fixed builds in research.json. Because the exploit trigger is undisclosed, treat this as an instability indicator and review the WER crash dump before escalating.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • CVE-2026-119948 / CVE-2026-105559 Exploitation Impact - Domain Controller Forced Restart After lsass.exe Critical Process Failure (Sentinel KQL) · unlock with TL Creds
  • CVE-2026-119948 Post-Exploitation - DCSync Directory Replication Request from Non-Domain-Controller Account (Sentinel KQL) · unlock with TL Creds
  • CVE-2026-119948 Post-Exploitation Lateral Movement - Executable Written to ADMIN$/C$ Share on Domain Controller (Sentinel KQL) · unlock with TL Creds
  • CVE-2026-105559 / CVE-2026-119948 Impact - Unexpected Termination of AD DS, KDC or Netlogon Service (Sigma) · unlock with TL Creds
  • CVE-2026-119948 Post-Exploitation - Member Added to Domain Admins / Enterprise Admins / Schema Admins / Administrators (Sigma) · unlock with TL Creds
  • CVE-2026-119948 Post-Exploitation C2 - Outbound Connection from lsass.exe to a Public IP Address (Sigma) · unlock with TL Creds
  • CVE-2026-119948 Post-Exploitation - Child Process Spawned by lsass.exe on Domain Controller (Splunk) · unlock with TL Creds
  • CVE-2026-119948 Precursor - Burst of Low-Privilege Network Logons to Domain Controllers from One Source (Splunk) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5739.

12 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

A separate Active Directory denial-of-service flaw, CVE-2026-105559 (6.5, Important), was reported alongside it.

Microsoft disclosed CVE-2026-119948 on 2026-11-10 as a Windows Active Directory remote code execution vulnerability. NVD describes it as a 'stack-based buffer overflow in Windows Active Directory [that] allows an authorized attacker to execute code over a network' and scores it CVSS 3.1 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness is mapped to CWE-121. The NVD record was in 'Awaiting Analysis' status at research time, so its details may change.

Exploitation requires network access and valid low-privileged credentials, no user interaction, and high attack complexity: specific conditions, such as particular protocol settings or configurations, must exist. Successful exploitation would give high impact to confidentiality, integrity and availability. Microsoft assessed exploitation as 'less likely', rated exploit code maturity as unproven, and reported no known exploitation and no public disclosure at release. The flaw was reported by an anonymous researcher. Microsoft has not disclosed the affected function, the network request required, or a working attack method, and no public proof-of-concept was identified in the sources reviewed. The sources do not establish that exploitation automatically yields SYSTEM privileges or domain control, and they treat earlier Active Directory privilege-escalation and security-feature-bypass flaws as distinct, not as part of an exploit chain with this issue.

A separate Active Directory denial-of-service vulnerability, CVE-2026-105559 (CVSS 6.5, Important), was reported in the same release. It is described as a network attack requiring low privileges, low complexity and no user interaction. No independent record of CVE-2026-105559 beyond the Cyber Security News article could be found at research time, so its technical details are unverified.

Patches are published per product through separate KBs: Windows Server 2025 (KB5131080 / KB5131077), Server 2022 (KB5131090), Server 2019 (KB5131085), Server 2016 (KB5131291), Windows 11 26H2/25H2/24H2 (KB5132061 / KB5132043), Windows 11 26H1 (KB5132059), Windows 11 23H2 (KB5131087), Windows 10 22H2/21H2 (KB5131096), Windows 10 1809 (KB5131085) and Windows 10 1607 (KB5131291). Administrators should apply the package matching each system's release and verify the resulting build number.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts

Lateral Movement

T1210 Exploitation of Remote Services

Impact

T1499 Endpoint Denial of Service; T1499.004 Endpoint Denial of Service: Application or System Exploitation

Resource Development

T1587.004 Develop Capabilities: Exploits

Remediation

Patches

  • Windows Server 2025: KB5131080 / KB5131077 (builds 10.0.26100.33822 / 10.0.26100.33730)
  • Windows Server 2022: KB5131090 (10.0.20348.5870)
  • Windows Server 2019 and Windows 10 1809: KB5131085 (10.0.17763.9487)
  • Windows Server 2016 and Windows 10 1607: KB5131291 (10.0.14393.9688)
  • Windows 11 26H2 / 25H2 / 24H2: KB5132061 / KB5132043 (10.0.26300.9974 / 10.0.26200.9974 / 10.0.26100.9974, or .9911 for KB5132043)
  • Windows 11 26H1: KB5132059 (10.0.28000.3501)
  • Windows 11 23H2: KB5131087 (10.0.22631.7711)
  • Windows 10 22H2 / 21H2: KB5131096 (10.0.19045.7846 / 10.0.19044.7846)

Immediate actions

  • Apply the Microsoft security update that matches each Windows Server / client release (see patches list), prioritizing domain controllers
  • Verify installed build numbers against the patched builds on every affected system
  • Review the MSRC advisories for CVE-2026-119948 and CVE-2026-105559

Workarounds

  • No vendor workaround was identified in the sources reviewed; patching is the documented mitigation

Longer-term hardening

  • Restrict network access to Active Directory services to required hosts and segments
  • Limit and monitor low-privileged domain accounts that can authenticate to domain controllers
  • Monitor domain controllers for unexpected service crashes or restarts of AD services

Affected and fixed versions

  • Microsoft — Windows Server
    Vulnerable versions: 2016; 2019; 2022; 2025
    Fixed in: 2025: KB5131080 / KB5131077; 2022: KB5131090; 2019: KB5131085; 2016: KB5131291
  • Microsoft — Windows 11
    Vulnerable versions: 23H2; 24H2; 25H2; 26H1; 26H2
    Fixed in: 26H2/25H2/24H2: KB5132061 / KB5132043; 26H1: KB5132059; 23H2: KB5131087
  • Microsoft — Windows 10
    Vulnerable versions: 1607; 1809; 21H2; 22H2
    Fixed in: 22H2/21H2: KB5131096; 1809: KB5131085; 1607: KB5131291

Timeline

Last updated · revalidated 1× · latest source

  • NVD published CVE-2026-105559 at 19:17 UTC (CWE-822 untrusted pointer dereference, CVSS 6.5, Awaiting Analysis); CVE-2026-119948 followed at 19:20 UTC.
  • Microsoft assessed exploitation as less likely and exploit code maturity as unproven; the flaw was credited to an anonymous researcher.
  • A separate Active Directory denial-of-service flaw, CVE-2026-105559 (CVSS 6.5, Important), was reported in the same release cycle.
  • Per-product updates released, including KB5131080/KB5131077 (Server 2025), KB5131090 (Server 2022), KB5131085 (Server 2019), KB5131291 (Server 2016) and KB5132061/KB5131096 for Windows 11/10.
  • NVD published the CVE-2026-119948 record (CVSS 3.1 7.5 HIGH, CWE-121); status Awaiting Analysis.
  • Microsoft disclosed CVE-2026-119948, a stack-based buffer overflow in Windows Active Directory allowing authorized remote code execution; security updates released the same day with no known exploitation and no prior public disclosure.
  • GBHackers reported the November 2026 Patch Tuesday release (1,093 new CVEs); only CVE-2026-124194 (Outlook spoofing) was marked exploited, and neither Active Directory CVE was.
  • Cyber Security News published coverage of CVE-2026-119948 and CVE-2026-105559 with the patch matrix.

Update history

Sources cited

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 5 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats