CVE-2026-119948
A NVD · · CVE-2026-119948
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- CVSS
- 7.5
- EPSS
- 0%
Key insight
The NVD entry provides only the bare vulnerability description without any information on exploitation, PoC or KEV status , the actual need for action only emerges from the Microsoft patch context and whether domain controllers are updated promptly.
Description
Entry CVE-2026-119948 describes a stack-based buffer overflow in Windows Active Directory. An attacker who already holds valid credentials can exploit the flaw over the network and thereby execute code on the target system. Environments with vulnerable Active Directory components, in particular domain controllers, are affected. At the time of publication, the NVD entry mentions neither active exploitation nor a proof of concept nor inclusion in the CISA KEV list. Severity and exploitability assessments therefore depend largely on Microsoft's information and on the patch level of the affected systems.
Risk score
- cvss base
- 75.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 75.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational