AD DS RCE with high attack complexity: CVE-2026-70229 on Patch Tuesday week

CVE-2026-70229 was patched in Microsoft's October 2026 Patch Tuesday update. It is a remote code execution vulnerability in Active Directory Domain Services (AD DS) with a CVSS 3.1 base score of 8.1 and an Attack Complexity rating of High (AC:H). The combination of RCE-on-domain-controllers and an 8.1 CVSS score warrants attention on any engagement against a Windows Active Directory environment.

MSRC advisory and NVD entry carry the authoritative technical details. Verify exact version and scope information there.

What AC:H means in practice

The CVSS Attack Complexity metric is frequently misread as a severity modifier that warrants deferral. It is not. AC:H means the exploit requires the attacker to win a race condition, achieve a specific timing window, meet a particular system state, or position themselves in a specific network location before the vulnerability is reachable. It does not mean the vulnerability is safe or that exploitation is infeasible.

For AD DS specifically, a well-positioned attacker on the internal network — which describes any engagement with existing foothold, any VPN-admitted session, or any domain-joined machine compromise — can often satisfy AC:H prerequisites by:

• Selecting the correct timing window for protocol-level operations (LDAP, Kerberos, replication traffic)
• Using adjacent host access to be in the right network position
• Leveraging existing protocol knowledge to meet the precondition state

Scope: Active Directory Domain Services

AD DS runs on domain controllers. Domain controllers are the highest-value targets in a Windows environment — they hold:

• The NTDS.dit (all domain password hashes)
• Kerberos KDC (ticket-granting service)
• Group Policy Objects
• Replication metadata across all DCs in the forest

RCE on a DC means NTDS.dit access, which means every domain account hash, which means the engagement is effectively complete from an attacker's objective standpoint. Deferring this patch on the assumption that AC:H is a mitigating factor is a miscalculation for any environment where internal network access is achievable.

Operator actions on a domain controller

If the engagement scope includes domain controllers and the October 2026 Patch Tuesday update has not been applied:

# Check installed patches on a DC -- look for October 2026 cumulative update
Get-HotFix |
    Where-Object { $_.InstalledOn -ge "2026-10-01" } |
    Select-Object HotFixID, Description, InstalledOn

# Identify DC role
(Get-WmiObject -Class Win32_ComputerSystem).DomainRole
# 4 = Backup DC, 5 = Primary DC

# Check AD DS service status
Get-Service NTDS | Select-Object Status, StartType

# Review DC OS version (patch matrix varies by build)
[System.Environment]::OSVersion.Version
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" |
    Select-Object CurrentBuild, DisplayVersion, UBR

The UBR (Update Build Revision) value identifies exactly which cumulative update is installed. Compare against the patched UBR listed in the MSRC advisory.

Affected configuration and patch matrix

Verify the exact affected/not-affected build numbers from the MSRC advisory — the table above is a guide only. Some server versions may have received the fix in a different update package.

Detection and hunt artifacts

Reporting notes

For engagement reports:

• List the DC OS version and the exact build number (UBR from registry query above).
• Compare against the patched UBR from the MSRC advisory.
• Note whether Windows Update is configured to receive updates automatically on the DC.
• If the DC is running Windows Server 2019 or earlier, flag whether it is within Microsoft's supported lifecycle — Server 2019 extended support ends Jan 2029, Server 2016 extended support ends Jan 2027.
• AC:H should be explained to the client: it is not a deferral justification; it is a condition that an attacker with network access to the DC may be able to satisfy.