CVE-2026-32072 is an improper authentication vulnerability (CWE-287) affecting Windows Active Directory on Windows 10 Version 1607 (build 10.0.14393.0). It allows a local attacker without privileges to spoof authentication, potentially bypassing security controls. The vulnerability has a CVSS 3.1 base score of 6.2, indicating medium severity, with attack vector local, low attack complexity, no privileges required, and no user interaction needed. Microsoft has released an official fix to address this issue.

An unauthorized local attacker can exploit this vulnerability to spoof authentication in Windows Active Directory, potentially gaining unauthorized access or impersonating legitimate users. The impact is limited to confidentiality as per the CVSS vector, with no direct integrity or availability impact reported. No known exploits are currently active in the wild.

Microsoft has released an official fix for this vulnerability. It is recommended to apply the official patch from the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32072 to remediate this issue. Since the vulnerability affects a specific Windows 10 version, upgrading to a patched version or applying the update is necessary. No additional mitigations are indicated by the vendor advisory.