What is the CVSS score of CVE-2026-57915?

CVE-2026-57915 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Apache Kerby are affected by CVE-2026-57915?

Apache Kerby, a Kerberos key distribution center used in enterprise authentication infrastructure, contains an authentication bypass vulnerability (CVE-2026-57915) affecting all versions before…. A patch is available.

How to fix or mitigate CVE-2026-57915?

Within 24 hours: Identify all systems running Apache Kerby below version 2.1.2 and document their criticality to your authentication infrastructure. Within 7 days: Develop and test an upgrade plan to Apache Kerby 2.1.2 in a non-production environment, coordinating with teams dependent on Kerberos services. Within 30 days: Deploy Apache Kerby 2.1.2 to all production KDC/AS instances and validate authentication functionality across dependent applications.

Apache Kerby CVE-2026-57915

EUVD-2026-39650 HIGH

Missing Critical Step in Authentication (CWE-304)

2026-06-26 apache

GHSA-262p-fj3f-xh7v

Authentication Bypass Apache Apache Kerby

7.3

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Remote unauthenticated AS-REQ with a crafted PA-DATA type (AV:N/AC:L/PR:N/UI:N); a bypassed-but-not-forged auth control yields partial C/I/A, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Jun 26, 2026 - 15:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 26, 2026 - 15:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 26, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

Jun 26, 2026 - 15:22 NVD

7.3 (HIGH)

Patch available

Jun 26, 2026 - 14:01 EUVD

Analysis Generated

Jun 26, 2026 - 13:20 vuln.today

DescriptionCVE.org

It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

Articles & Coverage 1

News 4 New Apache Vulnerabilities - 2 Critical, 2 High Severity Jun 27, 2026

AnalysisAI

Authentication bypass in Apache Kerby before 2.1.2 lets remote attackers defeat Kerberos pre-authentication by submitting a PA-DATA element with an unrecognized or unsupported type, causing the KDC to skip the pre-auth check rather than reject the request. The flaw affects all Apache Kerby deployments below 2.1.2 acting as a Kerberos KDC/AS, and is fixed in version 2.1.2. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS data was not provided; CVSS is rated 7.3 (High) with partial confidentiality, integrity, and availability impact.

Technical ContextAI

Apache Kerby is a Java-based Kerberos 5 implementation (KDC, AS, and supporting libraries) from the Apache Directory project, commonly embedded in Java applications and test/CI harnesses that need an in-process Kerberos authority. Kerberos pre-authentication (PA-DATA, typically PA-ENC-TIMESTAMP) is the mechanism by which a client proves possession of its long-term key before the AS issues a TGT, which is what defends against offline password-guessing and unauthorized ticket requests. The root cause maps to CWE-304 (Missing Critical Step in Authentication): when a PA-DATA entry carries a type the server does not recognize or support, Kerby fails to treat the absence of a valid recognized pre-auth proof as a failure, effectively letting the request proceed without completing the pre-authentication step. The single affected CPE is cpe:2.3:a:apache_software_foundation:apache_kerby:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: upgrade Apache Kerby to version 2.1.2, which the project states fixes this issue; this is the primary and recommended remediation. Review the Apache advisory at https://lists.apache.org/thread/1y3glgh3kzwoxo5m2lq504cjlh1dsrfh for release details and rebuild/redeploy any Java application that bundles Kerby so the embedded library is updated, since transitive copies will not be fixed by patching the host OS. If immediate upgrade is not possible, restrict network reachability of the Kerby KDC/AS listener (typically Kerberos port 88) to trusted client subnets via firewall or network ACLs to limit who can submit AS requests, accepting the trade-off that legitimate clients on untrusted networks will lose access; and increase KDC/AS logging and monitor for AS-REQ traffic containing unusual or unsupported PA-DATA types as a detection compensating control. Enforcing that pre-authentication is required for all principals at the realm/policy level is also advisable where configurable.