CVE-2026-33826: Microsoft Windows Active Directory improper input validation remote code execution

CVE-2026-33826 · Severity: high · CVSS 8 · Published 2026-04-14

A security vulnerability exists in Windows Active Directory, the service used by organizations to manage users, computers, and network permissions. An authorized user on the same local network could exploit this flaw to run unauthorized code on the server. This could lead to a full takeover of the identity management system, potentially compromising all accounts and data within the corporate network.

Technologies: Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012, Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Windows Server 2022 23h2, Microsoft Windows Server 2025. Vendors: Microsoft.

Quick answers

Is CVE-2026-33826 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33826 being exploited in the wild.
How severe is CVE-2026-33826?
High severity, with a CVSS score of 8, published 14 April 2026.
Which products and versions are affected?
Microsoft Windows Server 2012 R2 versions up to (excluding) 6.3.9600.23132; Microsoft Windows Server 2022, 23H2 Edition versions up to (excluding) 10.0.25398.2274; Microsoft Windows Server 2016 versions up to (excluding) 10.0.14393.9060; Microsoft Windows Server 2019 versions up to (excluding) 10.0.17763.8644; and 2 more.
Is there a fix for CVE-2026-33826?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-33826 attacked?
It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-33826?
Check whether you run Microsoft Windows Server 2012 R2, Microsoft Windows Server 2022, 23H2 Edition, Microsoft Windows Server 2012 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A remote code execution vulnerability exists in Windows Active Directory due to improper input validation (CWE-20). The vulnerability is reachable over an adjacent network and requires the attacker to have low-level authorized credentials (PR:L). An attacker who successfully exploits this vulnerability could achieve full system compromise (High Confidentiality, Integrity, and Availability impact). The issue affects multiple versions of Windows Server from 2012 R2 through 2025. Microsoft has released security updates to address this flaw; administrators should apply the latest cumulative updates for their respective server versions.

Affected products

  • Microsoft Windows Server 2012 R2 versions up to (excluding) 6.3.9600.23132
  • Microsoft Windows Server 2016 versions up to (excluding) 10.0.14393.9060
  • Microsoft Windows Server 2019 versions up to (excluding) 10.0.17763.8644
  • Microsoft Windows Server 2022 versions up to (excluding) 10.0.20348.5020
  • Microsoft Windows Server 2022, 23H2 Edition versions up to (excluding) 10.0.25398.2274
  • Microsoft Windows Server 2025 versions up to (excluding) 10.0.26100.32690

Timeline

  • 2026-04-14: disclosed: Initial disclosure by Microsoft
  • 2026-04-14: advisory: Microsoft Security Update Guide published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.