Active Directory Will Execute Code From a Packet That Never Authenticated. Microsoft's File ...

An unauthenticated attacker can trigger remote code execution in Windows Active Directory Domain Services by sending a specially crafted packet to an affected service over the network. The flaw, tracked as CVE-2026-70229 , requires no authentication and no user interaction. Microsoft’s own record attaches the conditions: exploitation needs specific network configurations and timing, has been observed only in limited scenarios, and does not work reliably in every environment.

The same record files the severity at CVSS 3.1 base 8.1, attack complexity high, vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. A 9.8 figure has circulated in secondary summaries of this CVE. Microsoft’s file serves 8.1. The difference is not cosmetic. A 9.8 describes an exploit that lands wherever it is aimed; the 8.1 says this one does not. Both agree on what happens when it lands – remote code execution on the directory service, full impact to confidentiality, integrity, and availability. They disagree on how often it lands, and that disagreement decides the patch tempo.

Exploitation status on the record: not publicly disclosed, not observed in exploitation, and labeled “Exploitation More Likely” – Microsoft’s judgment the shape of the flaw, not a report of a campaign. No CISA KEV listing was verified at filing, and none is asserted here.

The affected surface is wide and not server-only: Windows Server 2012 through 2025 including Server Core installations, Windows 10 versions 1607 through 22H2, and Windows 11 versions 23H2 through 26H2. Fixes ship with the October 2026 security update under KB articles 5126651, 5126657, 5127646, 5127648, 5126653, 5126655, 5126868, 5126836, 5126646, and 5126835. The client SKUs on the list are worth one line: this is not a server-role-only patch.

Against the week, this is where those failures were always headed. Each sat around the directory: AD FS token-signing hardening , the Golden SAML explainer on what a stolen signing key buys, IBM Verify Access deserializing untrusted data at its management interface, the Ivanti spoofing bypass at the VPN perimeter, BotSharp’s starter template shipping a trust root as a source constant, and the Keycloak masked-secret flaw rebinding stored credentials to an attacker’s endpoint. The self-hosted IdP side sits in the ZITADEL cluster and the four-provider identity window . None of them was the directory itself.

CVE-2026-70229 is. The file is CWE-863, Incorrect Authorization – not a missing login, an authorization check that fails. That is the week’s pattern at the bottom of the stack: a system trusting its own state without re-validating it. Every identity system above the directory takes its word for what is inside the domain. Tuesday’s update is the fix. The check that broke was the one the rest of the stack runs on.