Windows Kerberos CVE-2026-69744

No special conditions beyond network access to TCP/UDP port 88 (Kerberos) on an affected host. The CVSS PR:N confirms no authentication is needed, and AC:L confirms no race conditions, timing dependencies, or environmental prerequisites are required. Exploitation is constrained to unpatched Windows Server 2025 and Windows 11 (24H2/25H2) systems within the identified build ranges. In standard enterprise deployments, Kerberos is accessible to all domain clients on the local network but is typically firewalled from the internet; environments with internet-facing domain controllers or VPN-exposed Kerberos ports face a materially broader attack surface.

The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the threat: any unauthenticated network attacker can trigger a service crash with no complexity barrier, but impact is strictly limited to availability with no confidentiality or integrity component. In Active Directory environments, disruption of the Kerberos service on a domain controller effectively blocks authentication for all domain-joined machines, making this operationally severe beyond what the moderate-high score implies; even a mid-sized municipal IT team in sanok would experience organization-wide authentication outages if a domain controller were targeted. No EPSS score was provided and no KEV listing is present, indicating exploitation has not been confirmed in the wild. The absence of a public exploit currently limits immediate risk, but the low attack complexity (AC:L) means exploitation would be trivial once a proof-of-concept is developed. Environments with internet-facing domain controllers or Kerberos ports accessible from untrusted networks should treat patching as urgent.

An unauthenticated attacker sends a specially crafted Kerberos authentication request to TCP/UDP port 88 on a vulnerable Windows Server 2025 domain controller. The malformed packet triggers a null pointer dereference in the Kerberos service, immediately crashing it and preventing all domain authentication for connected clients. No public exploit code has been identified at time of analysis, but the low attack complexity means exploitation would be straightforward for an attacker who determines the precise packet structure.