Skip to content
Critical CVE-2026-70229 in Active Directory Requires Immediate Patching

Critical CVE-2026-70229 in Active Directory Requires Immediate Patching

First seen 14 Oct 2026, 19:36 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 20:38 UTC
  • •CVE-2026-70229 allows unauthenticated remote code execution in Active Directory.
  • •The vulnerability affects multiple Windows Server and client versions from 2012 to 2025.
  • •Patches were released on October 13, 2026, and should be applied immediately.

CVE-2026-70229 is a critical vulnerability in Windows Active Directory Domain Services that allows unauthenticated attackers to execute arbitrary code by sending specially crafted packets over the network. The flaw, rated CVSS 8.1, is due to incorrect authorization (CWE-863) and affects a wide range of systems, including Windows Server 2012 through 2025 and Windows 10 and 11 versions. While exploitation has not been publicly disclosed, Microsoft assesses it as 'Exploitation More Likely.' The vulnerability was published on October 13, 2026, alongside several others, including CVE-2026-105016, which has a higher CVSS score of 9.8. The October 2026 security update includes fixes for this flaw, and administrators are urged to apply the patches promptly to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-13
CVE-2026-70229 published
Microsoft disclosed CVE-2026-70229, a critical vulnerability in Active Directory, with a CVSS score of 8.1.
Windowsforum
2026-10-13
Patches released
Microsoft released security updates addressing CVE-2026-70229 and other vulnerabilities as part of the October 2026 Patch Tuesday.
Tech.Yahoo
2026-10-13
CVE-2026-105016 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-13
CVE-2026-96951 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-13
CVE-2026-108398 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (4)

Following this threat?

Track CVE-2026-105016 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

Which systems are affected by CVE-2026-70229?
Affected systems include Windows Server 2012 through 2025, Windows 10 versions 1607 through 22H2, and Windows 11 versions 23H2 through 26H2.
What is the severity of this vulnerability?
CVE-2026-70229 has a CVSS score of 8.1, indicating a high severity level.
What should organizations do to protect against this vulnerability?
Organizations should apply the security patches released on October 13, 2026, as soon as possible.