Windows KDC EUVD-2026-99889

Exploitation requires the attacker to already be an authenticated, low-privileged principal in the Active Directory domain (PR:L) with network reach to a domain controller running the Key Distribution Center (Kerberos) role - this is not remote-unauthenticated. The high attack complexity (AC:H) is itself the key limiting factor: success depends on satisfying specific, attacker-uncontrolled conditions (such as timing or a race window) rather than a deterministic single request. No user interaction is needed (UI:N). The flaw affects the KDC component present on Windows domain controllers; standalone/workgroup Windows hosts without the KDC role are not exposed. CISA SSVC rates it non-automatable, indicating it cannot be reliably weaponized against many targets.

This is a moderate-severity, lower-priority issue despite affecting a security-critical component. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.3) describes a network-reachable but high-complexity flaw that requires the attacker to already hold low-level privileges (PR:L), i.e. an authenticated domain principal. The high attack complexity (AC:H) implies non-trivial conditions such as timing, race, or specific environmental state that the attacker must win, which meaningfully dampens real-world exploitability. CISA's SSVC framework reinforces a lower-urgency posture: Exploitation=none (no observed activity), Automatable=no (cannot be reliably scripted at scale), though Technical Impact=total (a successful bypass fully defeats the targeted authorization control). EPSS is not provided in the input, so exploitation probability cannot be quantified. There is no KEV listing and no public exploit identified at time of analysis, so the strongest signals (active exploitation, POC) are both absent. Note a consistency point to verify: the vector rates C:H (full confidentiality loss) with I:N/A:N, which for a Kerberos authorization/security-feature bypass is plausible (disclosure of material enabling impersonation) but worth confirming against the Microsoft advisory, as a pure authorization bypass could alternatively manifest as an integrity impact. Overall: a legitimate patch-in-normal-cycle item for Active Directory operators, not an emergency, barring new exploitation signals.

An attacker who already holds valid but low-privileged credentials in an Active Directory domain sends crafted Kerberos/KDC traffic to a domain controller to defeat an authorization check and bypass a security feature over the network. No user interaction is required, but the high attack complexity means the attacker must satisfy specific timing or environmental conditions to succeed. No public exploit code is identified at time of analysis, so exploitation would require original research.