Microsoft CVE-2026-27912

This vulnerability exploits improper authorization enforcement (CWE-285) within the Windows Kerberos implementation, the default authentication protocol for Active Directory environments. Kerberos relies on ticket-granting services and authorization data embedded in service tickets to enforce access controls. The authorization flaw allows an attacker with low-privilege credentials to manipulate or bypass authorization checks during the Kerberos authentication process, potentially forging privileged access tokens or obtaining unauthorized service tickets. The adjacent network attack vector (AV:A) indicates the attacker must be on the same network segment as the target, typical in domain environments where Kerberos traffic occurs. All Windows Server versions from 2012 through 2025 are affected, including Server Core installations which are commonly deployed in enterprise infrastructure for reduced attack surface. The scope remains unchanged (S:U), meaning the vulnerability does not allow breaking out of the immediate security context, but achieves complete compromise within that context (C:H/I:H/A:H).