# Windows Active Directory RCE Vulnerability (CVE-2026-119948) Allows Code Execution Over a Network

> CVE-2026-119948 is a stack-based buffer overflow (CWE-121) in Windows Active Directory that lets an authorized, low-privileged attacker execute code over a network (CVSS 3.1 7.5, Important; attack complexity high). Microsoft released per-product security updates on 2026-11-10 and reported no known exploitation and no prior public disclosure. A separate Active Directory denial-of-service flaw, CVE-2026-105559 (6.5, Important), was reported alongside it.

- **Published:** 2026-11-11T07:42:36Z
- **Last reviewed:** 2026-11-11T13:01:08.496Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5739
- **ID:** TL-2026-5739
- **Severity:** HIGH (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 12
- **CVEs:** CVE-2026-119948, CVE-2026-105559

## Description

Microsoft disclosed CVE-2026-119948 on 2026-11-10 as a Windows Active Directory remote code execution vulnerability. NVD describes it as a 'stack-based buffer overflow in Windows Active Directory [that] allows an authorized attacker to execute code over a network' and scores it CVSS 3.1 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness is mapped to CWE-121. The NVD record was in 'Awaiting Analysis' status at research time, so its details may change.

Exploitation requires network access and valid low-privileged credentials, no user interaction, and high attack complexity: specific conditions, such as particular protocol settings or configurations, must exist. Successful exploitation would give high impact to confidentiality, integrity and availability. Microsoft assessed exploitation as 'less likely', rated exploit code maturity as unproven, and reported no known exploitation and no public disclosure at release. The flaw was reported by an anonymous researcher. Microsoft has not disclosed the affected function, the network request required, or a working attack method, and no public proof-of-concept was identified in the sources reviewed. The sources do not establish that exploitation automatically yields SYSTEM privileges or domain control, and they treat earlier Active Directory privilege-escalation and security-feature-bypass flaws as distinct, not as part of an exploit chain with this issue.

A separate Active Directory denial-of-service vulnerability, CVE-2026-105559 (CVSS 6.5, Important), was reported in the same release. It is described as a network attack requiring low privileges, low complexity and no user interaction. No independent record of CVE-2026-105559 beyond the Cyber Security News article could be found at research time, so its technical details are unverified.

Patches are published per product through separate KBs: Windows Server 2025 (KB5131080 / KB5131077), Server 2022 (KB5131090), Server 2019 (KB5131085), Server 2016 (KB5131291), Windows 11 26H2/25H2/24H2 (KB5132061 / KB5132043), Windows 11 26H1 (KB5132059), Windows 11 23H2 (KB5131087), Windows 10 22H2/21H2 (KB5131096), Windows 10 1809 (KB5131085) and Windows 10 1607 (KB5131291). Administrators should apply the package matching each system's release and verify the resulting build number.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1587.004 Develop Capabilities: Exploits
- T1210 Exploitation of Remote Services
- T1499 Endpoint Denial of Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-119948 AD Stack Overflow Indicator - lsass.exe Fault in AD Modules / NTDS Service Termination (Splunk)** (`TL-2026-5739-SPL-001`)

Behaviour-first detection for exploitation attempts against the CVE-2026-119948 stack-based buffer overflow (CWE-121) in Windows Active Directory, and for the related CVE-2026-105559 AD denial-of-service. A failed or high-complexity memory-corruption attempt against the directory service typically surfaces on a domain controller as an Application Error (EventID 1000) for lsass.exe with a stack-overrun/access-violation exception (0xc0000409 / 0xc0000005) or a fault module of ntdsai.dll/ntdsa.dll, or as an unexpected termination of the Active Directory Domain Services service (Service Control Manager 7031/7034). Microsoft reports no known exploitation and has not published the trigger, so this is a crash-and-instability indicator, not a signature of a specific exploit. Patched systems carry KB5131080, KB5131077, KB5131090, KB5131085, KB5131291, KB5132061, KB5132043, KB5132059, KB5131087 or KB5131096.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1210, T1499, T1499.004
- **Data sources:** windows_application_log, windows_system_log, wineventlog
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=wineventlog ((sourcetype="WinEventLog:Application" SourceName="Application Error" EventCode=1000 Message="*lsass.exe*" (Message="*c0000409*" OR Message="*c0000005*" OR Message="*ntdsai.dll*" OR Message="*ntdsa.dll*")) OR (sourcetype="WinEventLog:System" SourceName="Service Control Manager" (EventCode=7031 OR EventCode=7034) Message="*Active Directory Domain Services*")) | eval signal=if(sourcetype="WinEventLog:Application","lsass_fault_in_AD_module","ntds_service_terminated") | stats count min(_time) as first_seen max(_time) as last_seen values(signal) as signals by host | convert ctime(first_seen) ctime(last_seen) | table host signals count first_seen last_seen
```

### Microsoft KQL

```kql
Event
| where TimeGenerated > ago(24h)
| where (EventLog == 'Application' and Source == 'Application Error' and EventID == 1000
    and RenderedDescription has 'lsass.exe'
    and RenderedDescription has_any ('c0000409', 'c0000005', 'ntdsai.dll', 'ntdsa.dll'))
    or (EventLog == 'System' and Source == 'Service Control Manager' and EventID in (7031, 7034)
    and RenderedDescription has 'Active Directory Domain Services')
| project TimeGenerated, Computer, EventLog, Source, EventID, RenderedDescription
```

### Sigma

```yaml
title: Lsass.exe Fault in Active Directory Modules on Domain Controller - CVE-2026-119948
id: 7c1f2a54-3b8e-4d6a-9a1e-5f0c2b7d8e11
status: experimental
description: Detects an Application Error (EventID 1000) for lsass.exe with a stack-overrun or access-violation exception code or an Active Directory fault module. This can indicate a failed memory-corruption attempt against the CVE-2026-119948 Active Directory stack-based buffer overflow or the related CVE-2026-105559 denial of service.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119948
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105559
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.lateral-movement
    - attack.t1210
    - attack.impact
    - attack.t1499
    - attack.t1499.004
    - cve.2026-119948
    - cve.2026-105559
logsource:
    product: windows
    service: application
detection:
    selection_app:
        Provider_Name: 'Application Error'
        EventID: 1000
        Data|contains: 'lsass.exe'
    selection_fault:
        Data|contains:
            - 'c0000409'
            - 'c0000005'
            - 'ntdsai.dll'
            - 'ntdsa.dll'
    condition: selection_app and selection_fault
falsepositives:
    - Faulty third-party authentication or password-filter DLLs loaded into lsass.exe
    - Memory or hardware faults on a domain controller
level: high
```

**Known false positives:**

- Third-party password filters, authentication packages or security agents that crash lsass.exe on a domain controller
- Hardware or memory faults, or an administrator stopping Active Directory Domain Services during maintenance or patching

**Tuning notes:** Scope to domain controllers by host and suppress hosts in approved patch windows (the CVE-2026-119948 updates reboot DCs). Correlate hits with SPL-003 (authenticated network logon bursts from one source) and KQL-001 (forced DC restart) to raise confidence, and confirm the affected build against the fixed builds in research.json. Because the exploit trigger is undisclosed, treat this as an instability indicator and review the WER crash dump before escalating.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-119948 / CVE-2026-105559 Exploitation Impact - Domain Controller Forced Restart After lsass.exe Critical Process Failure (Sentinel KQL) (locked: unlock with TL Creds)
- CVE-2026-119948 Post-Exploitation - DCSync Directory Replication Request from Non-Domain-Controller Account (Sentinel KQL) (locked: unlock with TL Creds)
- CVE-2026-119948 Post-Exploitation Lateral Movement - Executable Written to ADMIN$/C$ Share on Domain Controller (Sentinel KQL) (locked: unlock with TL Creds)
- CVE-2026-105559 / CVE-2026-119948 Impact - Unexpected Termination of AD DS, KDC or Netlogon Service (Sigma) (locked: unlock with TL Creds)
- CVE-2026-119948 Post-Exploitation - Member Added to Domain Admins / Enterprise Admins / Schema Admins / Administrators (Sigma) (locked: unlock with TL Creds)
- CVE-2026-119948 Post-Exploitation C2 - Outbound Connection from lsass.exe to a Public IP Address (Sigma) (locked: unlock with TL Creds)
- CVE-2026-119948 Post-Exploitation - Child Process Spawned by lsass.exe on Domain Controller (Splunk) (locked: unlock with TL Creds)
- CVE-2026-119948 Precursor - Burst of Low-Privilege Network Logons to Domain Controllers from One Source (Splunk) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Windows Active Directory RCE Vulnerability Allows Attacker to Execute Code Over a Network](https://cybersecuritynews.com/windows-active-directory-rce-vulnerability/)
- [NVD API record for CVE-2026-119948](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-119948)
- [Microsoft Security Update Guide: CVE-2026-119948](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119948)
- [Microsoft Security Update Guide: CVE-2026-105559](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105559)
- [CWE-121: Stack-based Buffer Overflow](https://cwe.mitre.org/data/definitions/121.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5739