Microsoft has fixed a critical Windows LDAP flaw, CVE-2026-119958, scored 9.8 out of 10, that lets an attacker run code without logging in. The flaw, an out-of-bounds write in the Windows LDAP service, was patched on 10 November 2026 as part of Microsoft's November Patch Tuesday.

LDAP is the protocol that handles logins and directory lookups on Windows networks, and it runs on every domain controller. That is what makes this flaw so serious: crafted LDAP calls can run code in the LDAP service itself, and on a domain controller that puts the whole domain at risk. No login is needed, and no user has to click anything. Microsoft rates the flaw as critical and has assessed exploitation as less likely, but the company has warned that domain controllers should be patched as a priority.

Why domain controllers are the priority

Domain controllers hold the keys to a Windows network. If an attacker gains code execution there, they can create accounts, steal credentials and move across every connected system. That is why security researchers rank CVE-2026-119958 alongside the zero-click Windows Search flaw as one of the two most important non-zero-day fixes in this month's release. The fix ships in the normal November cumulative update, including KB5132061 for Windows 11 versions 24H2, 25H2 and 26H2 and the equivalent updates for Windows Server.

Administrators should patch domain controllers first, then other servers that expose LDAP, and restart them as the update requires. The November release fixed 1,094 flaws in total, with only the Outlook spoofing flaw CVE-2026-124194 marked as actively exploited. Action1 and NTCompatible both highlight CVE-2026-119958 as a top patching priority.