CVE-2026-70229

Name of the Vulnerable Software and Affected Versions Windows Active Directory Domain Services versions prior to 14393.9612 for Windows Server 2016 Windows Active Directory Domain Services versions prior to 17763.9376 for Windows Server 2019 Windows Active Directory Domain Services versions prior to 20348.5761 for Windows Server 2022 Windows Active Directory Domain Services versions prior to 26100.33650 for Windows Server 2025 Windows Active Directory Domain Services (affected versions not specified) for Windows Server 2012 Windows Active Directory Domain Services (affected versions not specified) for Windows Server 2012 R2 Windows Active Directory Domain Services (affected versions not specified) for Windows 10 Windows Active Directory Domain Services (affected versions not specified) for Windows 11

Description Incorrect authorization controls in Active Directory Domain Services allow an unauthenticated attacker to execute code over a network. This issue occurs when the system fails to properly verify permissions, potentially compromising the confidentiality, integrity, and availability of the affected system. Exploitation requires a network attack vector and specific conditions to be met, but does not require attacker credentials or user interaction.

Recommendations Update Windows Server 2016 to version 14393.9612 or newer. Update Windows Server 2019 to version 17763.9376 or newer. Update Windows Server 2022 to version 20348.5761 or newer. Update Windows Server 2025 to version 26100.33650 or newer. Apply the October 13 security updates for Windows Server 2012, Windows Server 2012 R2, Windows 10, and Windows 11. Restrict unnecessary access to directory services to minimize the risk of exploitation.