Windows Server 2012 CVE-2026-27912

Attacker requires low-privilege authenticated access to a system on the same adjacent network as the Windows target. Windows Kerberos must be active (default in domain-joined environments). No user interaction needed. Affects Windows systems with Kerberos authentication enabled.

This represents a significant risk in enterprise Active Directory environments despite requiring adjacent network access and low-level authentication. The CVSS score of 8.0 reflects high impact across confidentiality, integrity, and availability, with low attack complexity making exploitation straightforward for attackers who have achieved initial network presence. The adjacent network requirement (AV:A) limits remote internet-based attacks but is trivially satisfied by insider threats, compromised endpoints within the corporate network, or attackers who have achieved initial access through phishing or VPN compromise. The authenticated requirement (PR:L) is not a substantial barrier in enterprise environments where user credentials are often obtained through credential harvesting, password spraying, or social engineering. No EPSS score or KEV listing is available, and no public exploit code has been identified, suggesting this vulnerability has not yet been widely weaponized. However, Kerberos vulnerabilities historically attract attacker attention due to their central role in Windows domain authentication and lateral movement. The availability of vendor patches across all affected versions reduces risk for organizations with mature patch management, but the widespread deployment of Windows Server and the complexity of patching domain controllers creates extended exposure windows in many environments.

An attacker compromises a low-privilege domain user account through phishing and establishes presence on the corporate network via a compromised workstation. From this adjacent network position, the attacker exploits the Kerberos authorization flaw to request service tickets with elevated privileges, bypassing normal authorization checks. With these forged high-privilege tickets, the attacker authenticates to domain controllers or sensitive servers as a privileged account, gaining administrative access to critical systems, accessing protected data, or deploying ransomware across the domain.