CVE-2026-49164

Windows Active Directory Domain Services Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 54th percentile. A vendor fix is available.

CVSS 3.18.1High EPSS percentile54th0.8% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-22Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether the affected Windows machine is running Active Directory Domain Services (AD DS) and confirm its exact Windows version/build.
Compare the machine’s version/build to the fixed versions listed below and determine whether it is still vulnerable.
Apply the available updates/patches to reach one of the fixed versions for your specific Windows edition.
After patching, verify AD DS remains healthy and that the system reboots/finishes update installation successfully.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

This is a Windows Active Directory Domain Services flaw that could let an outsider run code on your server without needing an account; if you run AD DS, you should treat it as serious and plan to patch soon.

CVE-2026-49164 is an unauthenticated, network-triggered heap-based buffer overflow in Windows Active Directory Domain Services (CWE-122) that can lead to remote code execution on affected systems.

If you're affected

Full server takeover possible
Domain control compromise
Service disruption
Wormable spread risk within domain

What is it

Active Directory Domain Services is the “control center” Windows uses to manage logins, computer accounts, and group permissions. This bug is like a crack in a network-facing door: an attacker could potentially get the server to run their code remotely without needing a login.

Who is affected

This matters if you run or host Windows Active Directory Domain Services on Windows 10/11 or Windows Server 2012/2012 R2/2016/2019/2022/2025. The issue does not require an attacker to have a user account, but it still requires the target to be running the vulnerable AD DS service.

Only consider it a practical risk when your AD DS is reachable from an untrusted network (for example, from the internet, a DMZ, or any network segment attackers can reach).

How urgent is it

This should be treated as urgent (RED) because it allows remote code execution over the network without authentication, meaning a reachable AD DS system could be directly attacked. The findings provided do not show CISA KEV listing or confirmed dated exploitation in the press, but the impact is high enough that you should patch promptly.

What to do — in detail

Confirm exposure (quick checks):

Identify any Windows machines running Active Directory Domain Services (AD DS). If you’re unsure, check which servers hold the AD DS role (Domain Controller role).
Record the exact Windows edition and version/build number on each AD DS server.

Determine whether you’re vulnerable:

Compare each AD DS server’s version/build to the “fixed in” versions below for that specific edition.

Target fixed versions (upgrade paths):

Windows 10:
- Fixed in 10.0.14393.9339 (for the relevant Windows 10 branch)
- Fixed in 10.0.17763.9020
- Fixed in 10.0.19044.7548
- Fixed in 10.0.19045.7548
Windows 11:
- Fixed in 10.0.26100.8875
- Fixed in 10.0.26200.8875
- Fixed in 10.0.28000.2269
Windows Server:
- Windows Server 2012: fixed in 6.2.9200.26226
- Windows Server 2012 R2: fixed in 6.3.9600.23291
- Windows Server 2016: fixed in 10.0.14393.9339
- Windows Server 2019: fixed in 10.0.17763.9020
- Windows Server 2022: fixed in 10.0.20348.5386

Workaround if patching is delayed (containment):

Restrict network access to AD DS from untrusted networks. If AD DS is not needed from the internet or external networks, ensure firewall rules block inbound access from those networks.
If there is an edge/proxy or DMZ path to AD DS, remove or tightly lock down that connectivity until the fixed update is applied.

CISA due date:

Not provided (CVE-2026-49164 was not listed in the provided CISA KEV findings).

What to monitor:

After patching, verify AD DS health (replication and authentication) and review security logs for unusual network traffic patterns targeting AD DS services around the time of changes.

Technical context

Severity: High (remote code execution).

Weakness: CWE-122 (heap-based buffer overflow).

Mechanism/trigger: The findings describe a heap-based buffer overflow in Windows Active Directory Domain Services that can be triggered via network access without authentication, leading to remote code execution.

Attack vector: Network; no authentication and no user interaction required per the findings.

Exploitation status: The provided findings include no CISA KEV listing, no public exploit code, and no clear dated press claim of exploitation. However, the vulnerability’s remote, unauthenticated code execution nature is the key driver for urgency.

Patching: Fixed builds are provided per Windows edition/build for Windows 10, Windows 11, and multiple Windows Server releases.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS54th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.8% chance of exploitation activity in the next 30 days, which ranks it in the 54th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 27 days, from the signal feeds we watch.

2026-07-22Patch availablerecord updated
2026-07-16Patch availablerecord updated
2026-07-15Record updated
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated
2026-06-25OpenVAS check added

Affected products

Microsoftcommercial · US

And 22 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable