{"id":"CVE-2026-88165","published":"2026-10-13T19:21:37.020","lastModified":"2026-10-16T16:22:38.233","description":"Out-of-bounds write in Active Directory Domain Services allows an authorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-787"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88165","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An out-of-bounds write vulnerability in Active Directory Domain Services allows authorized attackers to execute arbitrary code remotely. This flaw occurs when processing certain network requests and can lead to complete domain compromise.","exploitability":"Exploitation requires an authenticated user with network access to the affected AD services, making it moderately difficult but achievable through credential compromise or lateral movement.","blast_radius":"If exploited, this vulnerability could allow attackers to gain full control over domain controllers and potentially compromise the entire Active Directory environment.","remediation":"Apply the latest Windows Server 2019 and Windows Server 2022 security updates that include the fix for CVE-2026-88165, specifically KB5068432 or later.","detection":"Monitor for unusual authentication patterns in Active Directory logs, particularly failed authentications followed by successful logins from unexpected IP addresses, and watch for abnormal network traffic to AD service ports (389, 636, 3268, 3269).","tags":["rce","ad","domain-controller","network"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:05:24.661Z"}}