BlackTreeCVE Intelligence
← Back to the CVE catalogue
Full vulnerability report · 2026
CVE-2026-119958High confidence

Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability

Microsoft · Windows 10 Version 1607

9.8CriticalCVSS 3.1
Recommended action
Within 72 hours

Critical technical impact with a remotely reachable, unauthenticated path; no CISA KEV confirmation is currently recorded.

Patch available
R
Operational reassessment

Published severity in operational context

Open reassessment dashboard →
Published severityCriticalOperational priority:Critical, unchanged from published severity.unchanged

Evidence used

  • No CISA KEV confirmation is currently recorded.
  • The selected CVSS metric records a network-reachable, unauthenticated path with no user interaction.
  • EPSS is 1.28% for the current model date.

Compensating controls

  • Validate the affected product branch and deploy the verified fixed release.
  • Restrict the affected network interface to trusted sources where business-safe.
  • Monitor vendor guidance and exploitation sources for a material change.

Verification

  1. Confirm that the asset runs Microsoft Windows 10 Version 1607 and falls inside the recorded affected range.
  2. Verify the installed build against the product-specific fixed version after deployment.
  3. Validate exposure, authentication requirements and compensating controls in the actual environment.
  4. Reopen this reassessment when CVSS, KEV, EPSS, exploit evidence or remediation changes.
Mitigation target: Within 3 daysRemediation target: Within 90 days

This automated reassessment organises public evidence. It does not know asset exposure, business impact or control effectiveness and does not replace CVSS or a human risk decision.

Direct vendor intelligence

Authoritative vendor CSAF and VEX advisories

Structured product status and remediation from the issuing vendor. Product-state explanations are always visible; large lists can be searched or downloaded.

1 current
msrc_CVE-2026-119958 · CSAF 2.0 · revision 1 · finalMicrosoft Security Response CenterWindows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
28 known affected

The vendor explicitly identifies these products as affected by this CVE.

  • Windows 11 Version 26H2 for x64-based Systems <10.0.26300.9974
  • Windows 11 Version 26H2 for ARM64-based Systems <10.0.26300.9974
  • Windows 11 Version 26H1 for ARM64-based Systems <10.0.28000.3501
  • Windows 11 version 26H1 for x64-based Systems <10.0.28000.3501
  • Windows 11 Version 25H2 for x64-based Systems <10.0.26200.9974
  • Windows 11 Version 25H2 for ARM64-based Systems <10.0.26200.9974
  • Windows Server 2025 (Server Core installation) <10.0.26100.33822
  • Windows Server 2025 <10.0.26100.33822
  • Windows 11 Version 24H2 for x64-based Systems <10.0.26100.9974
  • Windows 11 Version 24H2 for ARM64-based Systems <10.0.26100.9974
  • Windows 11 Version 23H2 for x64-based Systems <10.0.22631.7711
  • Windows 11 Version 23H2 for ARM64-based Systems <10.0.22631.7711
Summary
Microsoft
Remediation
10.0.14393.9688:Security Update:https://support.microsoft.com/help/5131291
Optional official sources

National CERT insights
?CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

Choose official national sources for this report. Each advisory shows its original language. Your selection is remembered on this device and included in shared links.

Recommended actionWithin 72 hours

Critical technical impact with a remotely reachable, unauthenticated path; no CISA KEV confirmation is currently recorded.

Patch available
01

What, why and how

Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.

What

Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.

Why

A bounds error lets data be written beyond the intended memory region, potentially corrupting control data.

How

An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may execute code or commands in the affected security context.

What

Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.

Why

A bounds error lets data be written beyond the intended memory region, potentially corrupting control data.

How

An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may execute code or commands in the affected security context.

02

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation
?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.
No confirmed evidence

No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.

Public PoC / exploit material
?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.
None recorded

No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.

Likely attack path
a network path → Out-of-bounds Write → execute code or commands in the affected security context
Attack surface
Network
Privileges required
None: unauthenticated exploitation is possible
User interaction
None
Attack complexity
Low: no specialised conditions are recorded
Security boundary
Unchanged: impact remains within the vulnerable component's security authority
Weakness
?CWE means Common Weakness Enumeration: a standard category for the underlying weakness.
CWE-787 ↗

CWE-787: Out-of-bounds Write. The product writes data past the end, or before the beginning, of the intended buffer.

CVSS vector
?CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Common Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.

AVNetworkAttack vector: The vulnerable component can be reached over a network.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRNonePrivileges required: The attacker does not need an account or existing privileges.UINoneUser interaction: No action by another user is required.SUnchangedScope: The security impact remains within the vulnerable component's authority.CHighConfidentiality impact: A successful attack can cause a major loss.IHighIntegrity impact: A successful attack can cause a major loss.AHighAvailability impact: A successful attack can cause a major loss.
Post-exploitation / living off the land
After compromise, an attacker may use built-in shells, scripting engines, scheduled tasks and native network utilities for discovery, persistence or movement. This is a plausible LoTL path, not evidence that it has occurred for every attack.
NetworkUnauthenticatedRemote code executionCWE-787
A

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

BSI · German · WID-SEC-2026-4478Microsoft Windows: Mehrere Schwachstellen

Ein Angreifer kann diese Schwachstellen in Microsoft Windows Server in den Versionen 2012, 2012 R2, 2016, 2019 und 2022, sowie in Microsoft Windows in den Versionen 10 und 11, im Microsoft Windows Admin Center und im Microsoft Configuration Manager ausnutzen, um erweiterte Berechtigungen – einschließlich Administratorrechte – zu erlangen, beliebigen Code auszuführen – sogar mit SYSTEM-Rechten –, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen, Spoofing-Angriffe durchzuführen und einen Denial-of-Service-Zustand auszulösen.

Official advisory ↗
INCIBE-CERT · Spanish · boletin-de-seguridad-de-microsoft-de-noviembre-de-2026Boletín de seguridad de Microsoft de noviembre de 2026

no autorizada de canalizaciones y ejecutar código en sus agentes. CVE-2026-120002: un control de autorización incorrecto en SharePoint Server podría permitir a un usuario autenticado elevar privilegios. CVE-2026-112967: un desbordamiento de búfer en Windows Xbox Live Networking Service podría permitir la ejecución remota de código. CVE-2026-116928: una escritura fuera de límites en Windows Search podría permitir ejecutar código. Microsoft documenta un escenario en el que Exchange procesa automáticamente un archivo adjunto para indexarlo. CVE-2026-116945: un desbordamiento de búfer en SQL Server podría permitir la ejecución remota de código. CVE-2026-119958: una escritura fuera de límites en Windows LDAP podría permitir a un atacante sin autenticar ejecutar código con los permisos del servicio. CVE-2026-119990. la falta de autenticación en una función de Azure OpenAI podía permitir una elevación de privilegios. Microsoft ha corregido el servicio. CVE-2026-85844: una vía alternativa de autenticación en Windows Kerberos podría permitir a un atacante elevar privilegios. CVE-2026-88218: una doble liberación de memoria en Windows DNS podría permitir la ejecución remota de código. CVE-2026-88234: la liberación de una referencia de memoria no válida en Windows iSCSI podría permitir la ejecución remota

Official advisory ↗
CERT-FR · French · CERTFR-2026-AVI-1513Avis du CERT-FR

embre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119948 du 10 novembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119950 du 10 novembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119951 du 10 novembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119952 du 10 novembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119953 du 10 novembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119954 du 10 novembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119955 du 10 novembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119957 du 10 novembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119958 du 10 novembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119959 du 10 novembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119960 du 10 novembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119961 du 10 novembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119962 du 10 novembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119963 du 10 novembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119964 du 10 novembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119965 du 10 novembre 2026 Bulletin de sécurité Microsoft Windows CVE-2026-119966 du 10 novembre 2026 Bulletin de sécurité Microsof

Official advisory ↗
CSIRT Italia · Italian · aggiornamenti-mensili-microsoft-26Aggiornamenti Mensili Microsoft

a - - CVE-2026-119953 : apre una nuova finestra - - CVE-2026-119390 : apre una nuova finestra - - CVE-2026-119392 : apre una nuova finestra - - CVE-2026-119391 : apre una nuova finestra - - CVE-2026-119393 : apre una nuova finestra - - CVE-2026-119821 : apre una nuova finestra - - CVE-2026-119835 : apre una nuova finestra - - CVE-2026-119382 : apre una nuova finestra - - CVE-2026-118745 : apre una nuova finestra - - CVE-2026-119834 : apre una nuova finestra - - CVE-2026-124170 : apre una nuova finestra - - CVE-2026-118748 : apre una nuova finestra - - CVE-2026-119837 : apre una nuova finestra - - CVE-2026-118735 : apre una nuova finestra - - CVE-2026-119958 : apre una nuova finestra - - CVE-2026-119824 : apre una nuova finestra - - CVE-2026-118747 : apre una nuova finestra - - CVE-2026-119945 : apre una nuova finestra - - CVE-2026-119957 : apre una nuova finestra - - CVE-2026-119839 : apre una nuova finestra - - CVE-2026-124176 : apre una nuova finestra - - CVE-2026-118749 : apre una nuova finestra - - CVE-2026-119944 : apre una nuova finestra - - CVE-2026-124185 : apre una nuova finestra - - CVE-2026-119387 : apre una nuova finestra - - CVE-2026-119386 : apre una nuova finestra - - CVE-2026-118737 : apre una nuova finestra - - CVE-2026-119826 : apre una nuova finestra - - CVE-2026-119389 : apr

Official advisory ↗
KISA KrCERT/CC · Korean · KNVD-7068MS 11월 보안 위협에 따른 정기 보안 업데이트 권고

9912 | Windows Kernel 권한 상승 취약성 | | Windows Kernel | CVE-2026-119918 | Windows Kernel 권한 상승 취약성 | | Windows Kernel | CVE-2026-119935 | Windows Kernel 권한 상승 취약성 | | Windows Kernel | CVE-2026-119965 | Windows Kernel 권한 상승 취약성 | | Windows Kernel | CVE-2026-122183 | Windows Kernel 권한 상승 취약성 | | Windows Kernel-Mode Drivers | CVE-2026-96139 | Windows Kernel-Mode Drivers 권한 상승 취약성 | | Windows Language Experience Service | CVE-2026-113766 | Windows Language Experience Service 변조 취약성 | | Windows Layer-2 Bridge Network Driver | CVE-2026-108402 | Windows Layer-2 Bridge Network Driver 서비스 거부 취약성 | | Windows LDAP - Lightweight Directory Access Protocol | CVE-2026-119958 | Windows LDAP - Lightweight Directory Access Protocol 원격 코드 실행 취약성 | | Windows Link Layer Topology Discovery Protocol | CVE-2026-88244 | Windows Link Layer Topology Discovery Protocol 원격 코드 실행 취약성 | | Windows Link Layer Topology Discovery Protocol | CVE-2026-116706 | Windows Link Layer Topology Discovery Protocol 원격 코드 실행 취약성 | | Windows Link Layer Topology Discovery Protocol | CVE-2026-116707 | Windows Link Layer Topology Discovery Protocol 권한 상승 취약성 | | Windows Link-Layer Discovery Protocol (LLDP) | CVE-2026-112975 | Windows Link-Layer Discovery Protocol (LLDP) 서비스 거부 취약성 | | Windows Link-Layer Discovery Protocol (LLDP) | CVE-2026-113816

Official advisory ↗
NCSC-NL · Dutch · NCSC-2026-0472Kwetsbaarheden verholpen in Microsoft Windows

Een kwaadwillende kan de kwetsbaarheden mogelijk misbruiken om beveiligingsmaatregelen te omzeilen, privileges te verhogen, willekeurige code uit te voeren en/of toegang te verkrijgen tot gevoelige informatie. De 13 ernstigste kwetsbaarheden bevinden zich in verschillende Windows-componenten en hebben een CVSS-score van 9,0 of hoger. Afhankelijk van de betreffende kwetsbaarheid kan misbruik leiden tot het uitvoeren van willekeurige code of het verkrijgen van verhoogde rechten. De betreffende kwetsbaarheden zijn weergegeven in onderstaande tabel. De overige kwetsbaarheden variëren in ernst van gemiddeld tot hoog. Het voert te ver om iedere kwetsbaarheid afzonderlijk in detail te behandelen in deze advisory. Raadpleeg het MSRC-portaal voor aanvullende informatie over de afzonderlijke kwetsbaarheden en de beschikbare beveiligingsupdates. ``` Windows iSCSI: |------------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |------------------|------|-------------------------------------| | CVE-2026-88234 | 9.80 | Uitvoeren van willekeurige code | |------------------|------|-------------------------------------| Windows Virtual Filtering Platform (VFP): |------------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |------------------|------|-------------------------------------| | CVE-2026-95962 | 9.00 | Uitvoeren van willekeurige code | |------------------|------|-------------------------------------| Windows DNS: |------------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |------------------|------|-------------------------------------| | CVE-2026-88218 | 9.80 | Uitvoeren van willekeurige code | |------------------|------|-------------------------------------| Windows Xbox Live Networking Service: |------------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |------------------|------|-------------------------------------| | CVE-2026-112967 | 9.80 | Uitvoeren van willekeurige code | |------------------|------|-------------------------------------| Microsoft Windows Media Foundation: |------------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |------------------|------|-------------------------------------| | CVE-2026-96157 | 9.80 | Uitvoeren van willekeurige code | |------------------|------|-------------------------------------| Windows DHCP Server: |------------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |------------------|------|-------------------------------------| | CVE-2026-88243 | 9.80 | Uitvoeren van willekeurige code | |------------------|------|-------------------------------------| Windows LDAP - Lightweight Directory Access Protocol: |------------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |------------------|------|-------------------------------------| | CVE-2026-119958 | 9.80 | Uitvoeren van willekeurige code | |------------------|------|-------------------------------------| Microsoft Color Management: |------------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |------------------|------|-------------------------------------| | CVE-2026-96067 | 9.80 | Uitvoeren van willekeurige code | | CVE-2026-96078 | 9.80 | Uitvoeren van willekeurige code | |------------------|------|-------------------------------------| Microsoft Exchange Server: |------------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |------------------|------|-------------------------------------| | CVE-2026-116928 | 9.80 | Uitvoeren van willekeurige code | |------------------|------|-------------------------------------| Windows Kerberos: |------------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |------------------|------|-------------------------------------| | CVE-2026-85844 | 9.80 | Verkrijgen van verhoogde rechten | |------------------|------|-------------------------------------| Windows Microsoft DirectMusic: |------------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |------------------|------|-------------------------------------| | CVE-2026-95882 | 9.80 | Uitvoeren van willekeurige code | | CVE-2026-95901 | 9.80 | Uitvoeren van willekeurige code | |------------------|------|-------------------------------------| ```

Official advisory ↗
03

Patch and workaround

Operational remediation based on structured source evidence.

Status
?Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.
Patch available
Affected
Fixed
Action
10.0.14393.9688:Security Update:https://support.microsoft.com/help/5131291
Workaround
No verified workaround is recorded. If business-safe, reduce exposure to the affected interface and allow only trusted sources until authoritative guidance is available.
04

Evidence and provenance

Published 10 Nov 2026 · Last source change 12 Nov 2026, 15:48 UTC · CWE-787 · Out-of-bounds Write

CVE recordCVE.org · 5.2
CVSS sourceCNA
EPSS source
?The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.
FIRST · tracked since 2026-11-12
European sourceNo official EUVD mapping
Product sourceVendor CSAF · Microsoft Security Response Center
Remediation sourceVendor CSAF · Microsoft Security Response Center
CWE sourceOther authority
NVD statusNVD awaiting enrichment

Core structured fields are present and their contributing authorities are shown above.

Material change intelligence

What changed after publication

View recent updates ↗
  1. Catalogue recordCVE added to the BlackTree catalogue.
    CNA ↗
Material fields only · duplicate refreshes suppressed · history retained for the configured operational retention period
CVE published
CVE authority or vendor reference↗Official CVE record (CNA and ADP data)↗NVD record↗
Technical terms and abbreviations used in this report
CVE
Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS
Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS
Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE
Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA
CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP
Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD
National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT
A computer security incident response team that publishes warnings or coordinates incident response.
PoC
Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF
Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL
Living off the land: abuse of legitimate tools or system functions during an attack.
Free version - for non-commercial use only.CVE-2026-119958 · cve.blacktree.nl