Active Directory CVE-2026-88165

Exploitation requires an authenticated low-privileged position in the environment (CVSS PR:L), network reachability to a vulnerable Active Directory Domain Services endpoint (AV:N), and a domain controller running an unpatched Windows Server build within the affected ranges (e.g. Windows Server 2025 <10.0.26100.33650, Server 2022 <10.0.20348.5761, Server 2019 <10.0.17763.9376, down through Server 2012/2012 R2, plus client builds hosting the AD DS component). The principal limiting factor is the authentication requirement - this is not reachable by fully unauthenticated attackers (PR:L, not PR:N) - which, combined with CISA SSVC Automatable: no, means exploitation is not expected to be mass/worm-style and depends on an attacker first gaining a valid domain credential.

This is a credible, high-priority vulnerability but not an emergency as of this analysis. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes network-reachable exploitation with low attack complexity, no user interaction, and only low privileges required (PR:L = an authenticated but low-level domain account), yielding full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) on an unchanged scope - appropriate for a code-execution out-of-bounds write (CWE-787) in a domain controller role. However, the exploitation signals argue against treating this as actively dangerous right now: CISA's SSVC framework reports Exploitation: none and Automatable: no, there is no CISA KEV listing, and no public POC is indicated - so there is no public exploit identified at time of analysis. SSVC Technical Impact: total is consistent with the C/I/A:H code-execution claim. The key tension to flag: the CVSS 8.8 base score is driven by the severe impact and low barrier, but the absence of exploitation evidence (SSVC 'none', no KEV, no POC) means real-world risk is currently latent rather than imminent. Given the target (Active Directory Domain Services, i.e. domain controllers), the potential blast radius if exploitation emerges is severe, so patching should be prioritized despite the current lack of exploit activity.

An attacker who already holds a low-privileged, authenticated foothold in the domain (e.g. a compromised standard user account) sends a crafted request over the network to a vulnerable Active Directory Domain Services endpoint, triggering an out-of-bounds write that corrupts memory and leads to arbitrary code execution on the domain controller. Because PR:L requires only low privileges and no user interaction, any authenticated principal could attempt this; no public exploit code is identified at time of analysis, so weaponization is not confirmed.