Back to vendor advisories
Microsoft Security Response CenterCVE-2026-33826

Windows Active Directory Remote Code Execution Vulnerability

CriticalVendor CVSS 8.0 / 10 1 CVE Published Apr 14, 2026 at 7:00 AM UTC

Summary

Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network.

Products covered

  • Windows Server 2019

  • Windows Server 2019 (Server Core installation)

  • Windows Server 2022

  • Windows Server 2022 (Server Core installation)

  • Windows Server 2025 (Server Core installation)

  • Windows Server 2022, 23H2 Edition (Server Core installation)

  • Windows Server 2025

  • Windows Server 2016

Show 3 more products
  • Windows Server 2016 (Server Core installation)

  • Windows Server 2012 R2

  • Windows Server 2012 R2 (Server Core installation)

Remediation

Install KB5082123. Install KB5082142. Install KB5082063. Install KB5082060. Install KB5082198. Install KB5082126.

Vendor-listed fixes

  • 10.0.17763.8644

  • 10.0.20348.5020

  • 10.0.26100.32690

  • 10.0.25398.2274

  • 10.0.14393.9060

  • 6.3.9600.23132

CVEs in this advisory 1

Updates

  1. Published by Microsoft Security Response Center

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.

  3. Confirmed at the source

    Our collector saw this advisory during a later source check.