CVE-2026-42914

What it actually does

CVE-2026-42914 is a Windows Kerberos memory-corruption vulnerability that can be triggered remotely by a low-privileged authenticated attacker under specific conditions. Successful exploitation can cause a denial of service in Kerberos-related processing, potentially disrupting the Kerberos Key Distribution Center or associated Windows authentication components. The vulnerability does not provide confidentiality or integrity impact based on the provided CVSS vector, but it can materially affect availability of authentication services.

Why it matters to the business

If exploited against domain authentication infrastructure, this flaw can interrupt user logons, application authentication, access to file shares, service account authentication, and other operations that depend on Kerberos. The operational risk is highest for domain controllers and Windows servers that support authentication-heavy workloads. Current public exploitation indicators are limited: EPSS is low at 0.00794, the 30-day trend is flat, there is no known CISA KEV listing, and no ransomware association is reported, but authentication outages can still create significant business disruption if the vulnerable systems are exposed to untrusted or broadly accessible authenticated users.

How an attack unfolds

An attacker first obtains or uses low-privileged Windows/domain credentials, then reaches a vulnerable Windows Kerberos service over the network. The attacker sends specially crafted Kerberos traffic that reaches the vulnerable parsing or processing path. Because the flaw is memory-corruption related and marked high complexity, exploitation likely depends on particular protocol state, target behavior, or environmental conditions rather than a simple single-packet crash. If successful, the malformed Kerberos interaction causes the affected component to fail or become unavailable, producing an authentication denial of service until the service recovers, the host is restarted, or failover occurs. There is no indication from the provided data that exploitation yields code execution, privilege escalation, or data theft.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. No exact fixed build or KB list was provided, so use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, or Microsoft Update Catalog to identify the superseding update that remediates CVE-2026-42914 for each supported OS version. Prioritize domain controllers, authentication servers, and systems that process Kerberos traffic. Where immediate patching is not possible, reduce exposure by limiting Kerberos access to trusted networks, restricting who can authenticate to sensitive systems, monitoring and rate-limiting suspicious authentication bursts where feasible, ensuring domain controller redundancy, and preparing operational failover procedures. Do not disable Kerberos broadly unless directed by Microsoft or as part of a controlled emergency workaround, because doing so can break normal Windows domain operations.

How to confirm the fix worked

Confirm remediation with authenticated patch validation rather than banner checks alone. Validate that each affected Windows host has installed the Microsoft cumulative/security update that includes the fix, using centralized patch tooling, Windows Update compliance reports, Microsoft Security Update Guide applicability data, or host-level checks such as Get-HotFix, Windows Update history, or Win32_QuickFixEngineering. For domain controllers, verify Kerberos authentication remains healthy after patching by checking successful domain logons, service ticket issuance, application authentication, and absence of KDC/LSASS crash events. Network validation should confirm Kerberos exposure is limited to expected clients and trusted network paths. Vulnerability scanners should be updated with current Microsoft detection logic and run with credentials to confirm patch applicability and installation state.

Typical attack path

1. Acquire or use a valid low-privileged Windows/domain account.
2. Identify reachable Windows systems or domain controllers exposing Kerberos services, commonly TCP/UDP port 88.
3. Send crafted Kerberos authentication traffic designed to trigger the vulnerable memory-corruption condition.
4. Cause Kerberos-related service failure, LSASS instability, KDC disruption, or authentication degradation.
5. Repeat or automate the traffic to prolong authentication outages or force operational failover.

How to detect it

Look for evidence of Kerberos-related denial of service rather than data theft. Primary log sources include Windows System logs, Application logs, Security logs, Directory Service logs on domain controllers, Kerberos Key Distribution Center operational logs if enabled, endpoint detection telemetry, crash dumps, Windows Error Reporting artifacts, and network telemetry for TCP/UDP port 88. Investigate clusters of KDC or LSASS crashes, service restarts, domain controller reboots, authentication failures, or sudden spikes in Kerberos requests from a single authenticated source. Useful Windows events include service termination events for KDC/Netlogon, application crash events for lsass.exe, Windows Error Reporting events, and Kerberos authentication failure events. Correlate the first crash or outage with Kerberos traffic sources, low-privileged accounts used shortly before the event, and repeated connections to port 88. Since no public exploit maturity or named threat actor activity is provided, treat these artifacts as suspicious operational indicators, not definitive proof of exploitation.

• TCP port 88 traffic spike to domain controllers
• UDP port 88 traffic spike to domain controllers
• lsass.exe
• kdcsvc.dll
• The Kerberos Key Distribution Center service terminated unexpectedly
• The Kerberos Key Distribution Center service entered the stopped state
• The Kerberos Key Distribution Center service entered the running state
• Event ID 7031
• Event ID 7034
• Event ID 1000
• Event ID 1001
• Faulting application name: lsass.exe
• Faulting module name: kdcsvc.dll
• Windows Error Reporting
• C:\Windows\System32\lsass.exe
• C:\Windows\System32\kdcsvc.dll
• C:\ProgramData\Microsoft\Windows\WER\ReportQueue
• C:\ProgramData\Microsoft\Windows\WER\ReportArchive
• KDC
• Kerberos-Key-Distribution-Center
• Microsoft-Windows-Kerberos-Key-Distribution-Center

What your security team should do

• Prioritize patching domain controllers and Windows servers that handle Kerberos authentication before lower-risk endpoints.
• Use Microsoft Security Update Guide or enterprise patch tooling to map the correct cumulative update or superseding KB for every affected Windows release.
• Review network access to Kerberos services and restrict TCP/UDP 88 exposure to trusted internal networks wherever operationally possible.
• Monitor domain controllers for KDC, Kerberos, and LSASS crashes, unexpected restarts, authentication spikes, and bursts of failed Kerberos events.
• Investigate any authentication outage or repeated KDC instability occurring after the publication date, especially if preceded by unusual Kerberos traffic from a low-privileged account or workstation.
• Ensure domain controller redundancy and authentication failover are functioning to reduce business impact from a successful denial-of-service attempt.
• Because EPSS is low, flat, and the vulnerability is not currently in CISA KEV, treat this as a prioritized availability-risk patch rather than an active mass-exploitation emergency unless local telemetry indicates probing or outages.