What is the CVSS score of CVE-2026-62795?

CVE-2026-62795 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Windows LDAP are affected by CVE-2026-62795?

A critical remote code execution vulnerability in Windows LDAP (CVE-2026-62795, CVSS 8.8) affects Windows 10, Windows 11, and all Windows Server editions in active use (2012-2025), enabling…. A patch is available.

How to fix or mitigate CVE-2026-62795?

Within 24 hours, conduct a rapid asset inventory to identify all systems running Windows 10, 11, Windows Server 2012, 2016, 2019, 2022, or 2025, and prioritize patching domain controllers, internet-facing systems, and servers handling sensitive data; review LDAP connection logs for any suspicious outbound connections to untrusted servers. Within 7 days, deploy Microsoft's latest security update addressing CVE-2026-62795 to all affected Windows infrastructure using your standard patch management process, beginning with tier-1 critical systems. Within 30 days, complete patch deployment across all remaining systems, verify patch installation through vulnerability scanning, and update your asset management system to reflect current patch status.

Windows LDAP CVE-2026-62795

EUVD-2026-56388 HIGH

Use After Free (CWE-416)

2026-08-11 secure@microsoft.com

GHSA-wr4v-hww6-vmhc

Denial Of Service Use After Free Memory Corruption Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable client-side UAF with no attacker-side privileges required; user interaction needed to establish LDAP connection to attacker server; full process-level C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 19:20 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Windows LDAP (Lightweight Directory Access Protocol) affects a broad swath of Microsoft Windows desktop and server editions, from Windows 10 through Windows 11 and Windows Server 2012 through 2025. A use-after-free memory corruption flaw (CWE-416) in the LDAP client implementation allows a network-accessible, unauthenticated attacker to achieve arbitrary code execution with high confidentiality, integrity, and availability impact, contingent on user interaction - most likely the victim system initiating or being induced to make an LDAP connection to an attacker-controlled server. No public exploit identified at time of analysis and no CISA KEV listing, but the CVSS score of 8.8 and the breadth of affected Windows versions make this a high-priority patching target.

Technical ContextAI

The vulnerability resides in the Windows LDAP client library, which implements the Lightweight Directory Access Protocol used for querying and modifying directory services (e.g., Active Directory). CWE-416 (Use After Free) occurs when a program continues to use a pointer referencing memory that has already been freed, allowing an attacker to influence the contents of that memory region and redirect execution flow. In LDAP client implementations, this class of bug is typically triggered by processing malformed or unexpected server-sent protocol messages - such as crafted search results, referrals, or extended operation responses - that cause the client to free an object and then dereference it during subsequent protocol handling. The attack vector (AV:N) confirms the flaw is exploitable over a network connection, and the unchanged scope (S:U) indicates the impact is confined to the LDAP client process itself, though high C/I/A ratings suggest process-level code execution.

RemediationAI

The primary remediation is to apply Microsoft's security update for the applicable Windows version, available via Windows Update, WSUS, or the Microsoft Update Catalog. Fixed build versions by platform are: Windows 10 1607 → 10.0.14393.9418, Windows 10 1809 → 10.0.17763.9115, Windows 10 21H2 → 10.0.19044.7663, Windows 10 22H2 → 10.0.19045.7663, Windows 11 23H2 → 10.0.22631.7517, Windows 11 24H2 → 10.0.26100.9168, Windows 11 25H2 → 10.0.26200.9168, Windows 11 26H1 → 10.0.28000.2704, Windows Server 2012/2012 Core → 6.2.9200.26279, Windows Server 2012 R2/R2 Core → 6.3.9600.23337, Windows Server 2016/Core → 10.0.14393.9418, Windows Server 2019/Core → 10.0.17763.9115, Windows Server 2022 → 10.0.20348.5499, Windows Server 2025/Core → 10.0.26100.33296. Full advisory details are at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62795. Where immediate patching is not feasible, consider restricting outbound LDAP connections (TCP/UDP port 389, LDAPS port 636) from sensitive hosts to only known-trusted directory servers using host-based or network firewall rules - note this may impact Active Directory authentication and LDAP-dependent applications. Do not allow workstations or servers to resolve LDAP referrals to externally controlled hosts.