EUVD-2026-35699
GHSA-f3mm-ch2c-m27j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconGain foothold on adjacent network segment
-
DeliveryAuthenticate as low-privileged domain user
-
ExploitCraft malformed Kerberos message with overflow trigger
-
InstallSend to target Kerberos service
-
C2Trigger integer wraparound and heap corruption
-
ExecuteHijack execution inside Kerberos service
-
ImpactExecute code in privileged service context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must be on an adjacent network to a vulnerable Windows host running the Kerberos service - typically the same Layer-2 segment, the same VLAN, or a logically adjacent network such as a connected VPN concentrator - meaning purely remote internet-based exploitation is not possible per the CVSS AV:A vector. The attacker must additionally hold low-level privileges (PR:L), which in a Kerberos context means a valid authenticated domain principal (any standard domain user account is sufficient; UI:N means no user interaction is required). Exploitation is further limited by high attack complexity (AC:H), implying the attacker must win a race, predict memory layout, or satisfy timing constraints that reduce reliability and make opportunistic mass exploitation impractical. |
| Impact | The CVSS vector AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H paints a nuanced picture: impact is total (full CIA compromise) but reachability is constrained by an adjacent-network attack vector (same broadcast/L2 segment or logical adjacency such as a VPN), high attack complexity (suggesting race conditions, memory layout dependence, or specific timing), and low privileges (an authenticated domain principal). There is no EPSS score, no CISA KEV listing, and no public POC referenced in the supplied intelligence, so this is not currently a mass-exploitation candidate. However, because the target is the Kerberos service in a Windows domain, successful exploitation could pivot toward domain-wide compromise; treat it as a high-priority patch for domain controllers and identity infrastructure even though widespread opportunistic exploitation is unlikely given the AV:A and AC:H constraints. |
| Exploit ScenarioDerived | An attacker who has compromised a low-privileged domain account and obtained a foothold on a workstation in the same VLAN as a domain controller sends a malformed Kerberos request whose length field is crafted to trigger the integer wraparound during message parsing. The resulting heap corruption is groomed across several attempts (consistent with AC:H) until execution is hijacked inside the Kerberos service, granting SYSTEM-level code execution on the domain controller. No public exploit identified at time of analysis, so this scenario remains theoretical pending vulnerability research disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Remote code execution in Microsoft Windows Kerberos implementation allows an authenticated attacker on an adjacent network segment to trigger an integer overflow and execute arbitrary code. The flaw is rated CVSS 7.1 (High) with high attack complexity and requires low-level privileges, and at the time of analysis there is no public exploit identified. Because Kerberos is a core authentication service in Windows domain environments, successful exploitation has direct implications for domain trust and identity security.
RemediationAI
Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47288 to all affected Windows clients and especially to domain controllers, where the Kerberos service is most exposed and most consequential; patch status here is best characterized as patch available per vendor advisory because an exact fixed build was not included in the supplied data. Until patches are deployed, compensating controls should focus on shrinking the adjacent-network attack surface: segment domain controllers onto management VLANs that exclude general user and guest traffic, enforce 802.1X or NAC on segments that host DCs to keep unauthorized devices off the same broadcast domain, and disable or restrict legacy Kerberos transports if not required (note that tightening UDP/88 or TCP/88 reachability will break authentication for any client that legitimately sits on a now-blocked segment, so validate site topology first). Monitor Kerberos service crashes and unexpected lsass.exe restarts as a detection signal for exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 17 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lies in Microsoft's Windows Kerberos authentication subsystem, which implements the Kerberos v5 protocol (RFC 4120) for ticket-based authentication across Active Directory environments. The root cause is CWE-190 (Integer Overflow or Wraparound), in which arithmetic operations on attacker-influenced size or length fields wrap past their numeric bounds, producing an undersized buffer allocation or an out-of-bounds index that subsequent code treats as valid. Tagging as both Integer Overflow and Buffer Overflow suggests the wraparound ultimately feeds a memory copy or parsing routine inside Kerberos message handling (likely AS-REQ/TGS-REQ or related PA-DATA structures), corrupting adjacent memory and enabling code execution within the Kerberos service context.
Know when Windows Server 2012 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to execute code over an adjacent network.
Executive ViewAI
CVE-2026-47288 in Microsoft Windows Kerberos enables arbitrary code execution by authenticated attackers with low-level privileges on adjacent networks, directly compromising domain authentication infrastructure and creating persistence pathways across Windows enterprise environments. No public exploit identified at time of analysis; however, the absence of vendor patches combined with Kerberos' role as the mandatory authentication backbone means organizations face material domain-wide compromise risk. Immediate compensating controls are required to reduce the window of exposure.
Network segmentation restricting domain controller access; firewall rules limiting port 88 (TCP/UDP) to authorized hosts only; disablement of legacy Kerberos protocols (RC4-HMAC, DES); enhanced authentication event monitoring and alerting for anomalous Kerberos activity; Windows Defender Credential Guard deployment to protect cached credentials; privilege access reviews reducing low-privilege account surface area; multifactor authentication requirements for privileged domain accounts; regular domain trust relationship audits.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Exploit-DB