EUVD-2026-56731
GHSA-92c8-rfc2-vg9x
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable but high complexity; low privileges required; integrity-only impact consistent with security feature bypass via cryptographic weakness.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network.
AnalysisAI
Inadequate encryption strength in Windows Active Directory enables a low-privileged authenticated network attacker to bypass a security feature, resulting in a high-integrity impact. Affected platforms span Windows Server 2022, Windows Server 2025, and multiple Windows 11 release channels (23H2 through 26H1). No public exploit identified at time of analysis; SSVC assessment confirms no observed exploitation and the attack is not automatable, placing this in a lower operational urgency tier despite the high integrity impact rating.
Technical ContextAI
CWE-326 (Inadequate Encryption Strength) describes situations where cryptographic algorithms or key lengths are insufficient to resist attack - for example, using deprecated cipher suites, short RSA keys, or weak hash functions in an authentication or signing protocol. Within Windows Active Directory, this class of flaw most commonly manifests in Kerberos negotiation, LDAP channel binding, or legacy NTLM-related cryptographic parameters. The CPE-implied affected products include Windows Server 2022 (build 10.0.20348.x), Windows Server 2025 (build 10.0.26100.x including Server Core), and Windows 11 versions 23H2, 24H2, 25H2, and 26H1 (builds 10.0.22631.x through 10.0.28000.x). The CVSS vector AV:N/AC:H/PR:L confirms the flaw is reachable over a network but requires high attack complexity and at least low-privilege credentials, consistent with a cryptographic downgrade or oracle attack scenario against an AD authentication exchange.
RemediationAI
Vendor-released patch is confirmed available. Apply the Microsoft security update that advances affected builds to the fixed versions identified by EUVD-2026-56731: Windows Server 2025 and Server Core should be updated to build 10.0.26100.33296 or later; Windows Server 2022 to build 10.0.20348.5499 or later; Windows 11 23H2 to 10.0.22631.7517 or later; Windows 11 24H2 and Server 2025 (shared branch) to 10.0.26100.9168 or later; Windows 11 25H2 to 10.0.26200.9168 or later; and Windows 11 26H1 to 10.0.28000.2704 or later. Obtain updates through Windows Update, WSUS, or Microsoft Update Catalog. Prior to patching, as a compensating control, organizations can reduce exposure by enforcing Kerberos armoring (FAST), disabling legacy authentication protocols (NTLMv1, RC4 Kerberos enctypes) via Group Policy, and restricting network access to domain controllers to known management hosts - note that disabling RC4 may break compatibility with older non-Windows Kerberos clients and should be tested in a staging environment first. Full details at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65777.
More in Windows 11 23h2
View allInternet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Windows SmartScreen Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.6), this vulnerability is remotel
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Same weakness CWE-326 – Inadequate Encryption Strength
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today