What is the CVSS score of CVE-2026-49179?

CVE-2026-49179 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Windows Active Directory are affected by CVE-2026-49179?

CVE-2026-49179, a command injection vulnerability in Windows Active Directory, enables remote code execution across enterprise infrastructure spanning Server 2012 through Windows 11 26H1 and Server…. A patch is available.

How to fix or mitigate CVE-2026-49179?

Within 24 hours, complete inventory of all Windows systems running Server 2012 through Server 2025 and Windows 11 26H1 to quantify organizational exposure, and implement controls to restrict user interaction with untrusted content reaching vulnerable AD components. Over the next 7 days, prioritize deployment of Microsoft-released patches to critical Active Directory infrastructure and high-traffic client systems. Within 30 days, complete enterprise-wide patch deployment to all affected Windows systems, with expedited timeline for systems supporting direct user access to Active Directory services.

Windows Active Directory CVE-2026-49179

EUVD-2026-56302 HIGH

Command Injection (CWE-77)

2026-08-11 secure@microsoft.com

GHSA-c36p-j9cw-hh2q

Command Injection Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable AD component, no attacker privileges needed, but user interaction required; full CIA impact consistent with arbitrary code execution.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:21 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 cve.org

HIGH 8.8

DescriptionCVE.org

Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network.

AnalysisAI

Command injection in Windows Active Directory enables network-based remote code execution against a broad range of Windows client and server versions, from legacy Server 2012 through Windows 11 26H1 and Server 2025. With a CVSS 8.8 and a vector of AV:N/AC:L/PR:N/UI:R, an unauthenticated remote attacker can execute arbitrary commands on affected systems when a local user performs a triggering action - such as processing a crafted request or interacting with attacker-controlled content that reaches the vulnerable AD component. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches across all affected branches.

Technical ContextAI

CWE-77 (Improper Neutralization of Special Elements used in a Command) describes a root cause where user-supplied input is incorporated into an OS- or interpreter-level command string without sufficient sanitization or escaping. In the context of Windows Active Directory, this class of flaw typically arises in components that construct LDAP queries, DNS operations, Kerberos processing routines, or administrative tooling that pass data to underlying Windows command facilities. The affected product is Windows itself across 19 distinct build ranges - spanning Windows 10 (build 14393 through 19045), Windows 11 (22631 through 28000), Windows Server 2012/2012 R2, 2016, 2019, 2022, and 2025 - as enumerated in EUVD-2026-56302. Active Directory is an integral Windows Server role and is also consumed by domain-joined client machines, making the attack surface broad wherever AD services are reachable over the network.

RemediationAI

Apply the vendor-released patches from Microsoft for each affected Windows version as enumerated in EUVD-2026-56302. The specific fixed builds are: Windows 10 22H2 → 10.0.19045.7663, Windows 10 21H2 → 10.0.19044.7663, Windows 10 1809/Server 2019 → 10.0.17763.9115, Windows 10 1607/Server 2016 → 10.0.14393.9418, Windows 11 23H2 → 10.0.22631.7517, Windows 11 24H2/Server 2025 → 10.0.26100.9168 (client) and 10.0.26100.33296 (server), Windows 11 25H2 → 10.0.26200.9168, Windows 11 26H1 → 10.0.28000.2704, Server 2022 → 10.0.20348.5499, Server 2012/Server Core → 6.2.9200.26279, Server 2012 R2/Server Core → 6.3.9600.23337. Consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49179 for the applicable KB article per build. As a compensating control where immediate patching is not feasible, restrict network access to Active Directory services (TCP/UDP 389, 636, 3268, 3269, 88, 445) from untrusted network segments - note this may disrupt domain authentication for non-domain-member clients. User awareness training to avoid interacting with unsolicited prompts or links involving domain authentication flows can reduce the likelihood of the required user interaction being triggered.