Active Directory Will Execute Code From a Packet That Never Authenticated. Microsoft’s File Carries 8.1, Not 9.8.

An unauthenticated attacker can trigger remote code execution in Windows Active Directory Domain Services by sending a specially crafted packet to an affected service over the network. The flaw, tracked as CVE-2026-70229 , requires no authentication and no user interaction. Microsoft’s own record attaches the conditions: exploitation needs specific network configurations and timing, has been observed only in limited scenarios, and does not work reliably in every environment. The same record files the severity at CVSS 3.1 base 8.1, attack complexity high, vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. A 9.8 figure has circulated in secondary summaries of this CVE. Microsoft’s file serves 8.1.

Source: Forkast