Windows Kerberos EUVD-2026-35726

Exploitation requires a low-privilege domain-authenticated account (CVSS PR:L), ruling out unauthenticated attacks from the internet or from hosts without existing domain credentials. The CVSS AC:H rating indicates that specific non-default conditions - such as precise message state, timing, or sequence requirements - must be met, and SSVC confirms this attack is not automatable. The attacker must have network connectivity to the target's Kerberos service on TCP/UDP port 88. No user interaction is required on the target side. Key limiting factors: the high attack complexity materially reduces ease of exploitation; low-privilege authentication is a hard prerequisite; scope is unchanged (S:U), confining the crash to the targeted system's Kerberos service process. Impact is most severe when the target is a domain controller acting as Key Distribution Center, since a KDC crash denies authentication domain-wide rather than to a single host.

CVSS 5.3 (Medium) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H places this in a moderate risk tier, but the AC:H constraint is operationally significant - it indicates non-standard conditions, race conditions, or specific message state are required for reliable triggering, and SSVC explicitly confirms Automatable: no. The PR:L requirement means unauthenticated internet exploitation is not possible; an attacker must first hold valid domain credentials. Despite the moderate score, operational impact in Active Directory environments is disproportionately severe: a downed KDC disrupts all domain authentication, which can cascade into widespread service outages. SSVC Technical Impact is rated 'partial' and Exploitation is 'none', corroborating the low urgency signal. This CVE is not in CISA KEV and no public exploit code has been identified, suggesting it has not yet attracted active attacker tooling. Defenders should weight the broad platform exposure (19+ distinct affected version ranges) against the AC:H friction and prioritize domain controllers and Kerberos-serving systems for earliest patching.

An attacker holding low-privilege domain credentials sends a specially crafted Kerberos authentication request - such as a malformed AS-REQ or TGS-REQ packet - to a vulnerable domain controller over TCP/UDP port 88. Under the specific high-complexity conditions required by AC:H (likely involving precise message structure or timing), the Kerberos parser performs an out-of-bounds read, causing the service to crash and rendering Kerberos-dependent authentication unavailable domain-wide. No public proof-of-concept code exists at time of analysis, and the AC:H rating means reliable triggering likely requires attacker knowledge of internal service state or specific sequencing conditions.