Windows Kerberos CVE-2026-70064

Requires the attacker to already have authenticated local access to the Windows host with at least low/standard-user privileges (PR:L, AV:L) - it is not remotely reachable and needs no user interaction once that foothold exists. Exploitation targets the Windows Kerberos security component and affects default installations across the enumerated Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server (2012/2012 R2/2016/2019/2022/2025, including Server Core) builds below the patched versions listed in the EUVD advisory. The limiting factor is the mandatory prior local authenticated access, which bounds this to post-compromise privilege escalation; SSVC marks it non-automatable, so it cannot be driven as mass or wormable exploitation.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity privilege-escalation requiring an already-authenticated low-privileged account, yielding total impact to confidentiality, integrity and availability - consistent with escalation to SYSTEM. The SSVC decision framework reinforces this reading: Technical Impact 'total' matches the C:H/I:H/A:H triad, but Exploitation is 'none' (no observed exploitation) and Automatable is 'no', indicating this cannot be weaponized into a self-propagating or mass-exploitation chain because it needs prior local access. There is no CISA KEV listing and no POC reported in the input, and no EPSS score was provided, so there is no signal of active exploitation or published exploit code. The signals are internally consistent: a serious local EoP that is a strong second-stage/post-compromise tool but requires an attacker to already be on the host, so it should be patched on normal priority for a widely-deployed OS component rather than treated as an exploited zero-day. Note a metadata conflict: the input Tags include 'Information Disclosure,' yet the description and CVSS (I:H/A:H) describe an integer-underflow elevation of privilege, not primarily information disclosure - treat the EoP framing as authoritative.

An attacker who has already gained a low-privileged foothold on a Windows host (e.g., via phishing, a standard user login, or a compromised service account) invokes the vulnerable Kerberos code path to trigger an integer underflow, corrupting memory to elevate to SYSTEM. No public exploit identified at time of analysis, and exploitation is local and low-complexity but requires that pre-existing authenticated access. It would typically be chained as the second stage after an initial-access vulnerability.