CVE-2026-119958

CriticalCVSS 9.8/10Last modified Nov 11, 2026

Description

Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 11, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-119966.4The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions uCVE-2026-119974.3The Bulk SEO Image plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.1. This is due to missCVE-2026-1199778.1WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging pathCVE-2026-1199788.5Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted CVE-2026-1199798.8LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to CVE-2026-119987.6A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrarCVE-2026-1199806.5The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized aCVE-2026-1199887.1Numeric truncation error in Windows SMB allows an authorized attacker to execute code over a network.CVE-2026-1199898.2Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execCVE-2026-119997.5X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affectCVE-2026-1199909.8Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.CVE-2026-1199915.9Weak authentication in Microsoft Configuration Manager allows an unauthorized attacker to disclose information over a network.
CVE-2026-119958: Critical severity, CVSS 9.8 | Vulnix