CVE-2026-42903

What it actually does

This vulnerability is a network-reachable denial-of-service flaw in the Windows Kerberos implementation. An authenticated attacker can send specially crafted Kerberos traffic that triggers a null pointer dereference in the Kerberos processing path, causing the affected component to crash or become unavailable. Because Kerberos is core authentication infrastructure on Windows systems, the highest-impact scenario is disruption of Kerberos authentication on domain controllers or systems processing Kerberos requests. The flaw does not provide code execution, privilege escalation, data theft, or integrity modification based on the provided information, but it can cause high availability impact.

Why it matters to the business

Successful exploitation can interrupt authentication-dependent operations such as user logons, service authentication, access to file shares, application single sign-on, and domain services. In environments that depend heavily on Active Directory and Kerberos, even a temporary Kerberos outage can cause broad operational disruption. The vulnerability is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has low and flat EPSS activity, and has no known public exploit maturity, so urgency is lower than for actively exploited flaws; however, domain controllers and authentication-critical Windows servers should still be prioritized because service disruption can have enterprise-wide consequences.

How an attack unfolds

An attacker first obtains valid low-privileged credentials or otherwise gains the ability to authenticate to a Windows environment that uses Kerberos. From a network position that can reach Kerberos services, typically TCP or UDP port 88 on a domain controller, the attacker sends crafted Kerberos messages designed to exercise the vulnerable parsing or handling path. When the vulnerable Windows Kerberos component processes the malformed authenticated request, it dereferences a null pointer and crashes or destabilizes the Kerberos service context. On domain controllers, this may interrupt ticket issuance and authentication for users, services, and computers until the affected service or host recovers, is restarted, or is patched.

How to fix it

Apply the Microsoft security update that remediates this vulnerability to all affected Windows versions, including supported Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems. Because no exact fixed build or KB list was provided, use Microsoft’s official Security Update Guide for CVE-2026-42903 to identify the applicable cumulative update for each OS version and install the June 2026 or later security update that contains the fix. Prioritize domain controllers, identity infrastructure, and servers that process Kerberos authentication. Where immediate patching is not possible, reduce exposure by restricting network access to Kerberos services to trusted internal networks, blocking unnecessary access to TCP/UDP 88 across segmentation boundaries, monitoring and rate-limiting suspicious Kerberos request patterns where feasible, and ensuring domain controller redundancy so authentication can fail over during an outage.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft cumulative update or security-only update that includes the fix for CVE-2026-42903. Validate using centralized patch reporting, Windows Update history, Microsoft Defender Vulnerability Management, WSUS, Configuration Manager, Intune, or equivalent endpoint management tooling. On representative systems, verify OS build numbers against Microsoft’s fixed build guidance for the applicable Windows release. Confirm that domain controllers and Kerberos-dependent servers have been rebooted if required by the update. From a defensive testing perspective, avoid destructive proof-of-concept testing in production; instead, validate exposure by confirming patch state, checking that Kerberos services are reachable only from expected network segments, and reviewing logs for absence of Kerberos-related crashes after patch deployment.

Typical attack path

1. Obtain or use valid low-privileged domain credentials.
2. Identify reachable Windows systems providing Kerberos authentication, especially domain controllers listening on TCP/UDP port 88.
3. Send crafted Kerberos authentication traffic to the affected system over the network.
4. Trigger the vulnerable null pointer dereference in the Windows Kerberos processing path.
5. Cause Kerberos authentication disruption, service crash, or host instability.
6. Repeat the crafted requests to sustain denial of service until mitigations or patches are applied.

How to detect it

To determine whether exploitation may have already occurred, review domain controller and Windows server logs for Kerberos processing failures followed closely by LSASS, Kerberos Key Distribution Center, or system restart events. Primary sources include Windows Security logs, System logs, Application logs, Windows Error Reporting logs, domain controller operational logs, EDR telemetry, and network telemetry for TCP/UDP 88. Look for bursts of Kerberos events such as 4768, 4769, 4771, or 4772 from the same source host or account immediately before Application Error event 1000, Windows Error Reporting event 1001, Service Control Manager event 7031/7034, unexpected shutdown event 6008, or Kernel-Power event 41. On domain controllers, pay particular attention to crashes involving lsass.exe or Kerberos/KDC-related modules and repeated recovery of authentication services. Network detection should focus on abnormal volumes of malformed or failed Kerberos AS-REQ or TGS-REQ traffic, repeated Kerberos failures from authenticated principals, and requests from unusual internal hosts. Since this is a denial-of-service flaw, durable host artifacts may be limited; absence of files or persistence mechanisms does not rule out exploitation.

• Faulting application name: lsass.exe
• Faulting process name: lsass.exe
• Kerberos Key Distribution Center service terminated unexpectedly
• The Kerberos Key Distribution Center service terminated unexpectedly
• Event ID 1000
• Event ID 1001
• Event ID 7031
• Event ID 7034
• Event ID 6008
• Event ID 41
• Event ID 4768
• Event ID 4769
• Event ID 4771
• Event ID 4772
• tcp.port == 88
• udp.port == 88
• Kerberos AS-REQ
• Kerberos TGS-REQ
• KRB_AP_ERR
• KDC_ERR
• C:\Windows\System32\lsass.exe

What your security team should do

• Prioritize patching domain controllers and authentication-critical Windows servers before general workstation fleets.
• Use Microsoft’s Security Update Guide to map each affected Windows version to the correct cumulative update or fixed build.
• Review firewall and segmentation rules to ensure Kerberos ports TCP/UDP 88 are not reachable from untrusted or unnecessary network zones.
• Increase monitoring on domain controllers for Kerberos service crashes, LSASS faults, unexpected restarts, and spikes in Kerberos failures from a single account or source address.
• Ensure domain controller redundancy and authentication service recovery procedures are tested so a Kerberos outage does not become a broader business outage.
• Correlate Kerberos errors with system stability events to distinguish ordinary authentication failures from attempted denial-of-service activity.
• Because EPSS is low, stable, and there is no KEV listing or known exploit maturity, handle this through normal but timely patch cycles unless domain controllers are externally exposed or authentication availability is especially critical.