Microsoft's November 2026 security updates fix a critical bug in Windows' implementation of LDAP, the Lightweight Directory Access Protocol that Active Directory and many enterprise applications use to look up users and computers. Tracked as CVE-2026-119958 and rated 9.8 out of 10, it "allows an unauthorized attacker to execute code over a network," in Microsoft's words.
The score reflects how little an attacker needs. Microsoft's CVSS vector marks the flaw as reachable over the network, with low attack complexity, no privileges and no user interaction required. In plain terms, an attacker who can reach a vulnerable LDAP service may not need a password or a victim's click to attempt exploitation.
An out-of-bounds write in a directory service
Microsoft classifies the issue as an out-of-bounds write, a bug where software writes data past the edge of the memory it was given. Uruguay's national CERT, CERTuy, which flagged the update in an advisory on 11 November, says an attacker could trigger it remotely with specially crafted LDAP requests and that successful exploitation could also affect the directory services an organization uses to authenticate and manage users. CERTuy lists Windows 10, Windows 11 and Windows Server as affected. Microsoft's advisory for CVE-2026-119958 carries the full list of affected builds and updates.
At the time CERTuy published, there was no evidence of active exploitation. That is the good news, and it is also a deadline: a critical, pre-authentication bug in a protocol that domain controllers serve on every Windows network is exactly what attackers study as soon as patches can be compared against unpatched code.
Two more network code-execution bugs in the same release
CERTuy grouped two other fixes from the same Patch Tuesday alongside it. Unlike the LDAP flaw, both require an attacker who already has some level of authorised access:
- CVE-2026-118146 (CVSS 8.8): incorrect authorization in Active Directory Domain Services that allows an authorized attacker to execute code over a network.
- CVE-2026-113825 (CVSS 7.5): a race condition in the Windows SMB Server network transport driver (srvnet.sys) that allows an authorized attacker to execute code over a network. Microsoft rates the attack complexity as high.
Microsoft has not published further technical detail on how any of the three is triggered, and its advisories remain the authoritative source for affected versions.
Install the November updates, domain controllers first
The fix is the November 2026 cumulative update for each supported Windows and Windows Server release. Neither Microsoft's CVE record nor CERTuy's bulletin lists a workaround, so patching is the remedy. Practical priorities:
- Patch domain controllers and any other server that answers LDAP requests first, because they are both the most exposed and the most valuable.
- Confirm that LDAP (TCP and UDP 389, and 636 for LDAPS) is never reachable from the internet, and limit which internal segments can reach it.
- Roll the same update out to Windows 10 and 11 endpoints, which CERTuy also lists as affected.
This release is better known for the Outlook flaw attackers were already using to steal credentials, which we covered on Patch Tuesday. The LDAP bug is quieter for now, but directory flaws have a way of becoming the main event: unpatched domain controllers remain one of the shortest paths from a foothold to an entire network.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.