Windows Server KDC EUVD-2026-73070

The attacker must hold a valid low-privileged Active Directory domain account (PR:L per CVSS) and have network connectivity to TCP/UDP port 88 on a Windows Server domain controller running the KDC service. No special configuration is required beyond a standard Active Directory domain deployment - KDC is enabled by default on every domain controller and cannot be disabled without breaking domain authentication. Exploitation is limited to principals that can authenticate to the domain; unauthenticated external attackers cannot reach the vulnerable code path without valid credentials. Exploitation complexity is low (AC:L), and no user interaction is needed from any administrator or victim.

CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a high-severity network-exploitable flaw requiring only low privileges. The low attack complexity and absence of user-interaction requirements mean that any authenticated domain user - including service accounts or accounts with minimal rights - could attempt exploitation from any network-accessible position reaching TCP/UDP port 88 on a domain controller. Domain controllers are critical infrastructure; code execution on a DC effectively means full Active Directory compromise, so the C:H/I:H/A:H impact ratings are well-grounded. No EPSS data was provided in the input, so exploitation probability cannot be quantified; the absence of KEV listing and public POC lowers immediate urgency marginally, but the low barrier (PR:L, AC:L) means any mid-sized enterprise network exposing KDC to authenticated users - which is by definition every Active Directory deployment - should treat patching as urgent. The 'Denial of Service' tag in the input metadata understates the actual impact: the CVSS triple-H and the description both confirm code execution, not merely availability loss.

An attacker with any valid low-privileged domain account (e.g., a standard user account or a compromised service account) sends a specially crafted Kerberos authentication request over the network to port 88 on a domain controller, triggering the use-after-free condition in the KDC request-handling path. Successful exploitation results in arbitrary code execution in the context of the KDC service process, which runs with high privileges on domain controllers, enabling full Active Directory compromise. No public exploit code is identified at time of analysis, but the low complexity and low privilege barrier make this an attractive target for post-authentication lateral movement.