Windows Active Directory CVE-2026-49179

Exploitation requires that a legitimate user on or connected to the domain perform some triggering interaction - the CVSS UI:R metric is explicit on this point. The exact nature of that interaction (e.g., clicking a crafted link, authenticating via a spoofed page, or processing a malicious LDAP referral) is not specified in the available description, but no prior authentication or privileges are required of the attacker (PR:N). The vulnerability is reachable over the network (AV:N), meaning the attacker does not require local or adjacent access. Limiting factors: exploitation cannot succeed without the required user interaction, which raises the bar above fully automated exploitation; systems not running Active Directory Domain Services or not joined to a domain may not expose the vulnerable component in the same way. Windows Server 2012 and 2012 R2 are included in the affected range, suggesting the flaw is not confined to modern AD implementations.

The CVSS 8.8 score is well-supported by the underlying vector: network-accessible (AV:N), low complexity (AC:L), no prior privileges (PR:N), with full CIA triad impact. The sole friction factor is UI:R - user interaction is required - which meaningfully reduces opportunistic mass exploitation compared to a fully automated wormable vector. EPSS data was not provided in the input; absent that signal, risk prioritization should rely on KEV status (not listed) and the extensive affected version range. The scope covers virtually every Windows version in active enterprise use today, including Server 2025 and Windows 11 26H1, making patch surface management nontrivial. No public exploit or CISA KEV listing exists at time of analysis, so this should be treated as high-priority patching rather than emergency incident response. The combination of no required privileges and network accessibility does, however, make this a compelling target for threat actors capable of engineering the user interaction step - for example, via phishing. CVSS indicates network vector and no privileges, consistent with the description's framing of an 'unauthorized attacker over a network,' so no vector conflict is apparent.

An attacker sends a crafted network request to an Active Directory service endpoint on a target Windows system. The attacker then induces a domain user - via phishing email or malicious web content - to trigger an interaction that causes the vulnerable AD component to process the attacker-controlled input. The command injection payload executes in the context of the service, granting the attacker arbitrary code execution with full CIA impact on the target system. No public exploit code has been identified at time of analysis, but the low attack complexity and no-privilege prerequisite make this a realistic threat for motivated actors capable of executing the social engineering step.