CVE-2026-70229 – Windows Active Directory Domain Services Remote Code Execution Vulnerability

Microsoft has addressed a Critical Remote Code Execution (RCE) vulnerability in Windows Active Directory Domain Services (AD DS). The vulnerability, tracked as CVE-2026-70229, allows an unauthenticated attacker to potentially execute malicious code on an affected system by sending specially crafted network packets. The issue originates from incorrect authorization controls within Active Directory Domain Services. Successful exploitation could compromise system confidentiality, integrity, and availability. Although exploitation requires specific network configurations and timing conditions, the vulnerability presents a significant security risk because attackers do not need authentication or user interaction.

CVSS SCORE: 8.1

SEVERITY: Critical

Threat

This vulnerability poses a serious threat to organizations using affected Microsoft Windows systems, particularly environments relying on Active Directory for authentication and access management.

An attacker could exploit the authorization weakness remotely to execute malicious code on a vulnerable system without requiring valid credentials.

The vulnerability has several concerning characteristics:

• Remote Attack: Attackers can target vulnerable services over the network.
• No Authentication Required: Attackers do not need a valid username or password.
• No User Interaction: Exploitation does not require users to open files, click links, or perform any actions.
• High Security Impact: Successful exploitation could compromise sensitive information, system integrity, and service availability.
• Complex Exploitation: Specific network configurations and timing conditions must be met for exploitation to succeed.

The combination of remote code execution and unauthenticated access makes this vulnerability particularly concerning for business-critical infrastructure.

Exploits

Microsoft has classified this vulnerability as Exploitation More Likely, indicating an increased likelihood of future exploitation.

However, the current exploitation status is:

• Actively Exploited: No
• Publicly Disclosed: No
• Exploit Code Maturity: Unproven
• Public Proof-of-Concept (PoC): Not confirmed
• Zero-Day Exploitation: Not reported

Although there are no confirmed reports of active exploitation, Microsoft considers exploitation more likely.

The vulnerability requires specific network configurations and timing conditions, making exploitation more difficult and less reliable across different environments.

Nevertheless, attackers could potentially develop reliable exploitation techniques as their understanding of the vulnerability improves.

Technical Summary

CVE-2026-70229 is a Remote Code Execution vulnerability caused by Incorrect Authorization (CWE-863) in Windows Active Directory Domain Services.

Active Directory Domain Services plays an important role in Windows environments by supporting centralized identity management, authentication, and access control.

The vulnerability occurs when an affected service does not correctly enforce authorization requirements, potentially allowing unauthorized requests to trigger code execution.

An unauthenticated attacker could attempt exploitation by sending a specially crafted network packet to an affected service.

If the required conditions are satisfied, the malicious request could trigger the authorization weakness and allow the attacker to execute code on the targeted system.

The vulnerability has the following technical characteristics:

• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high attack complexity indicates that exploitation depends on specific environmental conditions, including network configurations and timing requirements.

These conditions may prevent attackers from successfully exploiting every vulnerable system.

However, successful exploitation could allow unauthorized code execution, potentially resulting in system compromise, unauthorized data access, or disruption of critical services.

Exploitability

The vulnerability affects multiple Microsoft products, including:

• Windows Server: 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations.
• Windows 10: Versions 1607, 1809, 21H2, and 22H2.
• Windows 11: Versions 23H2, 24H2, 25H2, and 26H1.
• Microsoft Visual Studio: Version 2026 (18.10).

Affected Windows versions include applicable x86, x64, and ARM64 architectures.

An unauthenticated attacker could exploit the vulnerability remotely by sending specially crafted packets to an affected network service.

No privileges or user interaction are required, although successful exploitation depends on specific network and timing conditions.

Business Impact

This vulnerability presents a significant business risk because Active Directory is a critical component of identity and access management in many enterprise environments.

Successful exploitation could allow attackers to execute unauthorized code on vulnerable systems, potentially compromising essential business services.

Possible business consequences include:

• Unauthorized System Access: Attackers could execute malicious code on affected systems without valid credentials.
• Sensitive Data Exposure: Successful exploitation could compromise confidential business information.
• Operational Disruption: Compromised systems could experience service interruptions, affecting employee productivity and business operations.
• System Integrity Compromise: Attackers could potentially modify information or interfere with normal system operations.
• Financial and Reputational Damage: Security incidents could result in recovery expenses, operational losses, and reduced customer confidence.

Organizations relying heavily on Active Directory should pay particular attention to this vulnerability because a successful attack against critical identity infrastructure could have serious operational consequences.

A successful attack against critical identity infrastructure can turn one vulnerable system into a major business disruption.

Workaround

Microsoft has not identified any official mitigations or workarounds for this vulnerability.

The recommended action is to install the applicable Microsoft security updates.

If immediate patching is not possible, organizations should prioritize affected systems for remediation and closely monitor them for suspicious activity.

These precautions are not confirmed substitutes for the security update.

A system restart is required after installing the applicable updates.

Urgency

Priority: HIGH – Critical Security Update

CVE-2026-70229 should be prioritized for deployment because it allows potential remote code execution without authentication or user interaction.

Although active exploitation has not been reported, Microsoft has assessed exploitation as more likely.

The vulnerability’s Critical severity, CVSS score of 8.1, and potential impact on Active Directory environments make timely remediation important.

Organizations should prioritize patching affected Windows Server systems, particularly those supporting critical authentication and identity services.

Affected workstations and other listed Microsoft products should also be included in the deployment plan.

Because Microsoft has not identified any official workarounds, installing the applicable security updates is the primary remediation measure.

Delaying this patch could leave critical systems exposed to remote attacks that require neither stolen passwords nor user interaction.