Microsoft has fixed a critical remote code execution flaw in Windows Active Directory Domain Services, CVE-2026-118146, scored 8.8 out of 10, that lets an attacker with a valid account run code on a domain controller by exploiting an incorrect authorisation check. The flaw was patched on 10 November 2026 as part of Microsoft's November Patch Tuesday.

Active Directory Domain Services is the directory service that handles logins and permissions on Windows networks, and it runs on domain controllers. That is what makes this flaw so serious. A domain controller holds the keys to the network: the accounts, the groups and the policies that decide who can do what. If an attacker gains code execution there, they can create accounts, steal credentials and move across every connected system. The attacker needs a valid account first, which is why the score is 8.8 rather than higher, but Microsoft has assessed exploitation as more likely.

Why domain controllers come first

Not every server matters equally, and domain controllers matter most. They are the systems other machines ask when they need to know who a user is. A flaw in an ordinary workstation affects one machine; a flaw in a domain controller can affect the whole organisation. That is why security researchers rank CVE-2026-118146 among the most important fixes in this month's release, alongside the critical Windows Search and Windows LDAP flaws patched on the same day. Microsoft fixed 1,093 flaws in the November release, 63 of them rated critical, and only the Outlook spoofing flaw CVE-2026-124194 was marked as actively exploited.

What to do

Apply the November 2026 cumulative update to domain controllers first, then to other servers, and restart them as the update requires. After patching, review privileged accounts and remove rights that are no longer needed, so that a flaw like this buys an attacker as little as possible. Watch for unusual logins or new accounts on domain controllers in the days after patching. Organisations that cannot patch immediately should restrict network access to their domain controllers to only the systems that genuinely need it. Tenable and BleepingComputer both list CVE-2026-118146 among the notable fixes in the November release.

Frequently asked questions

Is CVE-2026-118146 being exploited? No. It was not flagged as exploited when the patch shipped on 10 November 2026, but Microsoft assessed exploitation as more likely, so domain controllers should be patched promptly.

Does the attacker need an account? Yes. This is an authenticated attack, so the attacker must hold valid credentials first. That is a real barrier, but it is not a defence on its own.

How does it differ from the Windows LDAP flaw? Both are critical 8.8 remote code execution flaws patched on the same day. The LDAP flaw, CVE-2026-119958, is an out-of-bounds write that needs no login, while this flaw is an incorrect authorisation check in Active Directory Domain Services that needs an authenticated attacker.