Skip to content

// #kerberos

5 articles

← All tags
🔑 IAM

Hardening Active Directory Against CVE-2026-47288 and the Kerberos Attack Surface

CVE-2026-47288 in the Windows Kerberos KDC is the most critical Active Directory vulnerability of 2026. Beyond patching, the Kerberos attack surface encompasses golden ticket attacks, AS-REP roasting, Kerberoasting, and credential relay. This article provides post-patch hardening guidance for enterprise AD environments.

#kerberos +8
🔑 IAM

Windows Kerberos KDC Remote Code Execution CVE-2026-47288 Puts Domain Controllers at Critical Risk

CVE-2026-47288 is a critical remote code execution vulnerability in the Windows Kerberos Key Distribution Centre that allows network-adjacent unauthenticated attackers to execute arbitrary code on Active Directory domain controllers. All supported Windows Server versions are affected. Domain controllers should be treated as the highest-priority patch target in the June 2026 update cycle.

#windows-server +8
🔑 IAM

April Windows Update Enforces AES-Only Kerberos — RC4 Fallback Blocked Across Active Directory

Microsoft's April 2026 cumulative update moves Windows domain controllers into AES-only Kerberos enforcement mode, permanently blocking RC4-HMAC as an authentication fallback under CVE-2026-20833. Organisations with legacy service accounts or unmanaged devices that have not set the msDS-SupportedEncryptionTypes attribute will begin seeing Kerberos authentication failures when the update is deployed.

#microsoft +8
🔑 IAM

Windows Kerberos Security Feature Bypass CVE-2026-24297 — Race Condition Enables Unauthenticated Network Attack

CVE-2026-24297 is a security feature bypass in the Windows Kerberos implementation caused by a race condition that can be triggered remotely without credentials or user interaction. Patched in the March 2026 Patch Tuesday, the vulnerability allows an attacker with network access to a Kerberos-speaking service to bypass security validation in the authentication flow. No active exploitation has been confirmed but the attack vector requires no credentials, increasing urgency.

#kerberos +6
🔑 IAM

Active Directory Privilege Escalation CVE-2026-25177 Added to CISA KEV — Domain Admin Risk via SPN Abuse

CVE-2026-25177, a privilege escalation vulnerability in Active Directory Domain Services patched in March's Patch Tuesday, has been added to CISA's Known Exploited Vulnerabilities catalogue. An authenticated attacker with low-privileged domain credentials can exploit improper SPN and UPN name validation to escalate to domain administrator level. The KEV addition confirms in-the-wild exploitation approximately three weeks after patching was available.

#active-directory +6

Commentary tagged #kerberos

Opinion

Active Directory Keeps Getting Owned Because We Keep Letting It

A Kerberos authentication bypass and an Active Directory privilege escalation were both patched this week, adding to a multi-year catalogue of critical flaws in Microsoft's foundational identity infrastructure. The problem is not that Microsoft keeps shipping vulnerabilities — it is that organisations keep deploying Active Directory in configurations that maximise their exposure when those vulnerabilities arrive.

CipherWatch Editorial

Security Intelligence Platform