Command injection in Microsoft Windows and Windows Server - CVE-2026-123387

Vulnerability details

The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper neutralization of special elements used in a command in Windows Active Directory Domain Services when generating the affected PowerShell remediation script. A remote user can use delegated directory permissions to rename an object with crafted characters to inject commands and escalate privileges when a privileged administrator generates and runs the script.

Affected software

How to mitigate CVE-2026-123387

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-123387
• https://support.microsoft.com/help/5131291

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows