CVE-2026-33826
Published: 14 April 2026
Summary
CVE-2026-33826 is a high-severity Improper Input Validation (CWE-20) vulnerability in Microsoft Windows Server 2012. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked in the top 23.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-33826 is an improper input validation flaw, categorized under CWE-20, that affects Windows Active Directory. The issue received a CVSS 3.1 base score of 8.0 reflecting an adjacent-network attack vector, low attack complexity, and low privileges required, with high impact on confidentiality, integrity, and availability.
An authorized attacker positioned on an adjacent network can supply crafted input to trigger remote code execution on the affected Active Directory component, enabling full compromise of the target system without user interaction.
Microsoft's advisory for the vulnerability is published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33826 and is the authoritative source for patch availability and mitigation guidance. The associated EPSS score remains low, with a current value of 0.0093 and a peak of 0.0108.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22645
Vulnerability details
Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE vulnerability in Windows Active Directory exploitable over adjacent network by low-privilege authorized attacker directly maps to remote service exploitation (T1210) and privilege escalation via software vulnerability (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation requires timely identification, reporting, and patching of vulnerabilities like this improper input validation flaw in Windows Active Directory, directly eliminating the exploit path.
Information input validation mandates checking the validity of all system inputs, directly addressing the CWE-20 improper input validation that enables arbitrary code execution in this CVE.
Boundary protection monitors and controls communications at network interfaces, mitigating adjacent network (AV:A) access required for low-privilege attackers to reach and exploit Active Directory.