CVE-2026-49179: Windows 10 1607 Active Directory RCE Flaw

CVE-2026-49179 Overview

CVE-2026-49179 is a command injection vulnerability in Windows Active Directory that allows an unauthorized attacker to execute code over a network. The flaw stems from improper neutralization of special elements used in a command [CWE-77]. Microsoft assigned the vulnerability a CVSS 3.1 score of 8.8 and published the advisory on August 11, 2026.

The issue affects a broad range of Windows client and server releases, including Windows Server 2012 through Windows Server 2025 and Windows 10 and 11 across multiple feature updates. Successful exploitation grants attackers high impact to confidentiality, integrity, and availability on the targeted host.

Critical Impact
An unauthenticated network attacker can execute arbitrary code on Windows Active Directory components, enabling full compromise of domain-joined infrastructure when a user interacts with attacker-supplied content.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-49179 published to the National Vulnerability Database
2026-08-11 - Microsoft releases the security update via MSRC
2026-08-13 - EPSS score updated to 0.831% (54.382 percentile)
2026-08-13 - Last modified in the NVD database

Technical Details for CVE-2026-49179

Vulnerability Analysis

CVE-2026-49179 is a command injection weakness classified under [CWE-77] that resides in Windows Active Directory. The affected code path fails to neutralize special elements before they are passed to a downstream command interpreter. An attacker who controls those elements can append or alter commands executed by the underlying process.

Exploitation requires network access to the target and user interaction, as reflected in the CVSS attack vector. The scope is unchanged, meaning code executes within the security authority of the vulnerable component. Because Active Directory processes typically run with elevated privileges, code executed through this flaw can pivot into domain-wide operations.

Root Cause

The root cause is improper input neutralization in an Active Directory command-handling routine. Untrusted input flows into a command construction step without adequate sanitization, allowing metacharacters and command separators to alter the intended execution. This class of defect commonly arises when structured input is interpolated into shell or command strings without parameterization or allowlisting.

Attack Vector

The attack originates over the network. An attacker crafts a malicious payload that reaches an Active Directory service or client-side component, then relies on a user action to trigger processing. Once the crafted input reaches the vulnerable command handler, injected directives execute in the process context. No prior authentication is required, which broadens the pool of viable attackers to include external actors who can reach Active Directory endpoints or lure a privileged user into interacting with malicious content.

No public proof-of-concept exploit or CISA Known Exploited Vulnerabilities listing exists for CVE-2026-49179 at time of publication. See the Microsoft Security Update CVE-2026-49179 advisory for vendor technical details.

Detection Methods for CVE-2026-49179

Indicators of Compromise

Unexpected child processes spawned by Active Directory service binaries such as lsass.exe, ntdsutil.exe, or related LDAP handlers.
Command lines containing shell metacharacters (&, |, ;, backticks) passed through directory service operations.
New or modified scheduled tasks, services, or accounts created shortly after inbound LDAP or RPC activity to a domain controller.
Outbound network connections from domain controllers to untrusted external hosts following user interaction with directory-related content.

Detection Strategies

Baseline normal process ancestry for Active Directory services and alert on deviations, especially interpreter processes (cmd.exe, powershell.exe) launched from directory service parents.
Inspect LDAP, RPC, and Netlogon traffic for payloads containing command metacharacters or encoded shell sequences.
Correlate authentication events on domain controllers with subsequent process execution and privilege changes to identify post-exploitation activity.

Monitoring Recommendations

Enable Windows Advanced Audit Policy for Directory Service Access and Process Creation, and forward events to a centralized analytics platform.
Monitor privileged group changes (Domain Admins, Enterprise Admins) and Kerberos ticket anomalies that may follow code execution on a domain controller.
Track patch compliance across all domain controllers and Active Directory-integrated servers to identify systems still exposed to CVE-2026-49179.

How to Mitigate CVE-2026-49179

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-49179 to all affected Windows client and server systems.
Prioritize domain controllers and Active Directory-integrated servers, then remediate remaining Windows 10, Windows 11, and Windows Server hosts.
Restrict administrative interaction on domain controllers until patching is complete, and review recent process execution history on those systems.

Patch Information

Microsoft published the patch through the Microsoft Update Catalog and Windows Update on August 11, 2026. The fix is distributed as part of the monthly cumulative update for each supported Windows build. Refer to the Microsoft Security Update CVE-2026-49179 page for the specific KB article and package identifiers that map to each affected version.

Workarounds

Limit inbound network access to domain controllers using host-based firewall rules and network segmentation until patches are deployed.
Enforce least privilege for accounts that interact with Active Directory tooling to reduce the impact of user-interaction-based exploitation.
Educate administrators about the user interaction requirement and discourage opening untrusted directory-related content on privileged systems.

bash

# Verify installation status of the Windows security update on a target host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Restrict inbound LDAP/RPC to domain controllers from trusted subnets only
New-NetFirewallRule -DisplayName "Restrict LDAP to Trusted Subnets" `
  -Direction Inbound -Protocol TCP -LocalPort 389,636 `
  -RemoteAddress 10.0.0.0/8 -Action Allow