Search: CVE-2026-118148

Improper authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.

Microsoft's November 2026 Patch Tuesday addresses 1095 vulnerabilities across multiple products, including 64 critical issues. Among these, 48 are remote code execution vulnerabilities. One vulnerability, CVE-2026-124194 in Microsoft Office Outlook, has been exploited in the wild and involves spoofing due to lack of UI warnings for unsafe actions. Several high-severity remote code execution and elevation of privilege vulnerabilities affect Windows components, Active Directory, Microsoft Exchange Server, and Microsoft Office applications. Microsoft highlights certain vulnerabilities as more likely to be exploited, including CVE-2026-113862 (Windows NAT), CVE-2026-118146 and CVE-2026-118148 (Active Directory), CVE-2026-118207 (Exchange Server), and CVE-2026-119952 (Windows Schannel).