CVE-2026-123387
A NVD · · CVE-2026-123387
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- CVSS
- 8.0
- EPSS
- 0%
Key insight
The entry provides only raw NVD data on the vulnerability , no information on exploitation in the wild, PoC availability, affected versions or patch status, so no prioritised risk assessment is possible.
Description
CVE-2026-123387 concerns a command injection (Improper Neutralization of Special Elements used in a Command) in Windows Active Directory. According to the description, an already authorised attacker can exploit the flaw over the network to elevate privileges. This affects the central identity and authentication infrastructure of Windows domain environments. The NVD entry contains no information on a public proof of concept, observed exploitation in the wild, or inclusion in the CISA KEV list. Details on specifically affected product versions and patch status are also absent from the alert.
Risk score
- cvss base
- 80.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 80.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational