August 2026 Patch Tuesday: AD Domain Controller RCE Trio

The August 2026 Patch Tuesday Active Directory Domain Controller RCE Cluster

Microsoft's August 2026 Patch Tuesday, released August 11, 2026, fixed roughly 400 CVEs across its product line (BleepingComputer counted 400 flaws and three zero-days in the release) — but the entry that should stop Active Directory administrators mid-scroll is the August 2026 Patch Tuesday Active Directory domain controller RCE cluster: three separate remote-code-execution vulnerabilities, one apiece on Windows DNS Server, Active Directory Certificate Services (AD CS), and Active Directory Domain Services (AD DS) — the three roles that, between them, define what a domain controller does. All three were published by Microsoft on August 11, 2026.

This article sticks to what Microsoft's own advisories and named security outlets have published as of writing. Where public detail is genuinely thin — and for one of these three, it is — that gap is called out explicitly rather than filled in.

For related domain-controller-critical patching history, see Zerologon (CVE-2020-1472) Enforcement: Why It's Still Missing on So Many DCs and Certighost (CVE-2026-54121) AD CS: Low-Privileged Users Can Impersonate a Domain Controller — the July 2026 AD CS flaw that this month's AD CS RCE joins on the "patch the CA now" list.

CVE-2026-62878 — Windows DNS Server RCE (CVSS 9.8, wormable)

CVE-2026-62878 is the most severe of the three. It's a stack-based buffer overflow (CWE-121) in Windows DNS Server that lets an unauthenticated remote attacker execute code over the network with no user interaction, by sending a specially crafted packet to an affected DNS service — CVSS 3.1 base score 9.8 (windowsforum.com, cvefeed.io). The Zero Day Initiative and multiple outlets covering the release describe the flaw as wormable, meaning a single exploited DNS server could be used to automatically compromise others without further attacker interaction (Zero Day Initiative's August 2026 Security Update Review; SecurityAffairs).

⚠️

⚠️ Warning: Microsoft rates exploitation as "less likely" and states the flaw is neither exploited in the wild nor publicly disclosed as of the August 11, 2026 release (windowsforum.com, SecurityAffairs). That is a snapshot, not a guarantee — wormable, unauthenticated, CVSS 9.8 flaws are exactly the profile that historically moves to active exploitation once a public PoC lands.

CVE-2026-62878 wasn't the only DNS Server RCE in this cycle. CrowdStrike's August 2026 Patch Tuesday analysis counted four Critical Windows DNS Server RCEs total this release — CVE-2026-62878 (9.8), CVE-2026-62817 (8.8), CVE-2026-62820 (8.1), and CVE-2026-65789 (8.1) — all reachable by sending crafted packets to an affected DNS server with no user interaction required. Any DC running the DNS Server role needs all of them, not just the headline CVE.

CVE-2026-62818 — Windows AD CS RCE (CVSS 8.8, use-after-free)

CVE-2026-62818 is a Critical remote-code-execution flaw in Active Directory Certificate Services: a use-after-free (CWE-416) that a low-privileged, authenticated remote attacker can trigger over the network with no user interaction and low attack complexity — CVSS 3.1 base score 8.8 (windowsforum.com). Unlike the DNS flaw, this one requires the attacker to already hold a low-privileged account with network access to the CA — but AD CS is frequently the domain's root of trust for certificate-based authentication, smart cards, VPN access, internal TLS, and device identity, so a remote-code-execution bug there deserves priority well beyond a routine "patch the server" instruction (CrowdStrike).

This is the second AD CS RCE-class flaw to hit domain-controller-adjacent infrastructure in as many patch cycles — see the Certighost write-up for July 2026's CVE-2026-54121, a different mechanism (enrollment-fallback impersonation rather than use-after-free) on the same CA infrastructure. If your Enterprise CA is still catching up on July's patch, August's CVE-2026-62818 lands on the same to-do list — for the broader certificate-template attack surface beyond either CVE, see ADCS Certificate Attacks: How ESC1 to ESC8 Lead to Domain Admin.

CVE-2026-49179 — Windows AD DS RCE (the one still short on public detail)

CVE-2026-49179 is a Windows Active Directory Domain Services remote-code-execution vulnerability, also published August 11, 2026 at 7:00 a.m. Pacific (windowsforum.com). Here's what is not yet public: Microsoft's advisory does not establish the attack path, the affected Windows Server versions, the authentication requirement, or a CVSS base score. Microsoft has not stated whether the flaw is pre-authentication, Internet-reachable, exploited in the wild, or capable of full-forest compromise (windowsforum.com).

ℹ️

ℹ️ Note: this is a genuine information gap, not an oversight in this article. Treat CVE-2026-49179 as must-patch on priority of component alone — AD DS is the core domain-controller role — and check MSRC's Security Update Guide directly for your specific server builds before finalizing a patch rollout plan, since advisory detail is sometimes filled in after initial publication.

Detection: What to Watch for Right Now

None of the three CVEs has a public proof-of-concept or confirmed in-the-wild exploitation as of this writing, so the highest-value "detection" lever today is patch-compliance visibility, not IOC hunting. The table below adds the general indicators that would matter if exploitation attempts start.

Indicator	Signal	Source	Why it matters here
DNS Server crashes/restarts	Service crash entries and unexpected child processes spawned by `dns.exe`	Windows Event Log (Application/System); Elastic's "Unusual Child Process of dns.exe" detection rule	A stack-based buffer overflow like CVE-2026-62878 is likely to crash the service before an exploit succeeds — repeated crashes or restarts on a DNS-role DC, or dns.exe spawning an unexpected child process, both warrant investigation
Certificate issuance anomalies	Event ID 4886 (request received), 4887 (issued), 4888 (denied)	Microsoft Learn: Audit Certification Services	CVE-2026-62818 requires interacting with the CA's request/issuance path; these events are only logged if Certificate Services auditing is enabled on the CA
Patch/build compliance	WSUS, Intune, or SCCM update-compliance status against the August 2026 cumulative update for each DC's exact OS build	Vendor patch management tooling	With CVE-2026-49179's attack path undocumented publicly, the single highest-confidence signal available today is knowing exactly which DCs are still missing the update — anything not reporting compliant should be treated as exposed

💡

💡 Tip: enable Certificate Services auditing (auditpol /get /subcategory:"Certification Services") before relying on 4886/4887 telemetry — it is not on by default in every AD CS deployment.

# Inventory which servers hold each DC-critical role before patching
Get-ADDomainController -Filter * | Select-Object Name, OperatingSystem, IPv4Address
Get-WindowsFeature -Name DNS, ADCS-Cert-Authority | Where-Object Installed

Remediation: Patch Priority for AD Shops

Patch DNS-Server-role DCs first. CVE-2026-62878 is unauthenticated, network-reachable, wormable, and CVSS 9.8 — the highest-risk profile of the three. Include the other three DNS Server RCEs from this cycle (CVE-2026-62817, CVE-2026-62820, CVE-2026-65789) in the same update.
Patch AD CS Certification Authorities next. CVE-2026-62818 requires an authenticated low-privileged attacker, which lowers urgency slightly relative to the DNS flaw, but any CA is a domain-wide root of trust — treat it as a near-term, not a "next maintenance window," fix. For CA hardening beyond this month's patch, see Weak Certificate Mapping in AD CS: Why Strong Binding Matters.
Patch every remaining domain controller for AD DS. Even without public attack-path detail, CVE-2026-49179 sits on the core DC role. Don't wait for more detail to patch; use the component alone as justification.
Inventory before you patch. Many small and mid-sized environments co-locate the DNS Server, AD CS CA, and AD DS roles on the same box — one DC may need all three fixes applied in a single maintenance window. The PowerShell snippet above is a starting point for that inventory.
If you can't patch DNS-role DCs immediately, restrict inbound DNS service exposure to trusted network segments only as a stopgap. This reduces exposure; it does not replace the patch.
Validate after patching. Confirm DNS resolution, certificate enrollment/auto-enrollment, and AD DS replication all still function normally post-update before closing the maintenance window.

🚨 Danger: three RCEs landing on the DC role surface in one release is not a coincidence to shrug off — DNS, AD CS, and AD DS between them handle name resolution, certificate-based authentication, and the directory itself. A single unpatched DC exposed on any one of these three services is a viable entry point.

None of these three CVEs is itself a misconfiguration EtcSec's audit catalogue can flag — they're missing-patch conditions, and EtcSec audits configuration and privilege exposure, not hotfix inventory. What the catalogue does surface is how much damage a DC compromise via any of these paths could do next: DCSync-capable permissions identify which accounts could pull directory secrets if an attacker rides one of these RCEs into a domain controller, and ADCS Weak Permissions flags CA-level hardening gaps independent of this month's patch — both reduce blast radius even though neither detects CVE-2026-62878, CVE-2026-62818, or CVE-2026-49179 directly.

ℹ️

ℹ️ Note: EtcSec automatically checks for DCSync-capable permissions and ADCS misconfigurations during every AD audit. Run a free audit to verify your environment's broader exposure while you confirm patch status for all three August 2026 CVEs.

August 2026 Patch Tuesday Active Directory Domain Controller RCE: 3 Flaws You Can't Defer