CVE-2026-47288

What it actually does

CVE-2026-47288 is an integer overflow or wraparound vulnerability in Windows Kerberos processing. An authenticated attacker with low privileges and network adjacency can send specially crafted Kerberos traffic that causes incorrect size or bounds calculations, potentially leading to memory corruption and remote code execution. Because Kerberos services are security-critical and commonly run in highly privileged Windows processes on domain infrastructure, successful exploitation could provide code execution with elevated privileges and enable compromise of authentication services. The CVSS vector indicates high confidentiality, integrity, and availability impact, but also high attack complexity and a requirement for prior authorization and adjacent-network access.

Why it matters to the business

Successful exploitation could compromise Windows authentication infrastructure, allowing an attacker to disrupt logons, tamper with authentication flows, or gain a foothold with broad impact across Windows-dependent business services. Domain controllers and Windows servers are especially sensitive because Kerberos underpins user and service authentication. The issue is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has low EPSS probability at this time, but the operational impact of compromise is high because authentication outages or domain-level compromise can affect many applications and users simultaneously.

How an attack unfolds

An attacker first obtains valid low-privileged credentials in the Windows domain or another environment using Kerberos. The attacker must also be positioned on an adjacent network path capable of reaching Kerberos services, typically TCP or UDP port 88 and potentially related Kerberos password-change services on port 464. They then send malformed Kerberos messages designed to trigger an integer wraparound during parsing or allocation. If the vulnerable code path is reached and heap or memory layout conditions are favorable, the resulting memory corruption may be shaped into code execution in the Kerberos-handling process. Depending on where the vulnerable component is running, this may lead to execution in a highly privileged Windows security context, service crash, authentication disruption, or deeper domain compromise. Public exploit maturity is currently reported as none, so exploitation is likely non-trivial and would require custom research.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-47288 to all affected Windows Server systems, including Windows Server 2012, 2016, 2019, 2022, and 2025. No specific fixed build numbers were provided in the input, so use the latest applicable cumulative update or security-only update from Microsoft for each supported server version. Prioritize domain controllers, Kerberos Key Distribution Center hosts, and servers exposed to untrusted or semi-trusted adjacent networks. Where immediate patching is not possible, restrict Kerberos access to only required trusted network segments, block unnecessary inbound TCP/UDP 88 and TCP/UDP 464 exposure, enforce network segmentation around domain controllers, monitor Kerberos traffic anomalies, and reduce the number of users or systems that can authenticate from lower-trust networks. Do not rely on service restarts or configuration changes as a permanent fix; memory corruption flaws require vendor patching.

How to confirm the fix worked

Confirm that every affected Windows Server has installed the Microsoft cumulative or security update that includes the fix for CVE-2026-47288. Validate patch state using Windows Update history, Microsoft Update Compliance, endpoint management tooling, or PowerShell inventory of installed hotfixes and OS build numbers. Verify that domain controllers and Kerberos-serving systems are included in the patch inventory, not just member servers. Confirm network controls by testing that Kerberos ports TCP/UDP 88 and TCP/UDP 464 are reachable only from expected trusted network ranges. Review vulnerability scanner results after patching to ensure the CVE is no longer reported. If compensating controls were used, validate firewall and segmentation rules with packet captures or controlled connection tests from adjacent network zones.

Typical attack path

1. Acquire or use valid low-privileged domain credentials.
2. Gain network adjacency to affected Windows Kerberos services, commonly domain controllers or Windows servers reachable on Kerberos ports.
3. Identify affected Windows Server versions that have not received the relevant security update.
4. Send specially crafted Kerberos authentication or ticket-related messages to the vulnerable service.
5. Trigger integer overflow or wraparound during Kerberos message handling.
6. Achieve memory corruption, causing either service instability or controlled code execution.
7. Use resulting access to execute commands, dump credentials, alter authentication behavior, or move laterally if privileged execution is obtained.

How to detect it

Because public exploit maturity is currently reported as none, there may be no stable, CVE-specific indicators. Hunt for suspicious activity on domain controllers and Windows servers running Kerberos. Review Windows Security logs for unusual Kerberos authentication patterns, especially Event ID 4768, 4769, and 4771 spikes, malformed or failed requests, repeated failures from a small set of adjacent-network hosts, or Kerberos activity from systems that do not normally request tickets. Review System and Application logs for LSASS, Kerberos Key Distribution Center, or KDC service crashes, restarts, Windows Error Reporting entries, and unexpected reboots. Analyze network telemetry for abnormal Kerberos traffic to TCP/UDP 88 or TCP/UDP 464, unusual packet sizes, repeated failed sessions, or high-volume Kerberos requests from non-standard clients. In EDR data, investigate LSASS anomalies, unexpected child processes, suspicious memory access, credential dumping behavior, or post-exploitation actions immediately following Kerberos service instability. If crash dumps exist for LSASS or Kerberos components, preserve them for forensic analysis and compare timestamps to Kerberos network activity. Absence of these artifacts does not prove non-exploitation because successful memory-corruption exploitation may leave limited application-level logging.

• Event ID 4768
• Event ID 4769
• Event ID 4771
• Microsoft-Windows-Kerberos-Key-Distribution-Center
• Kerberos-Key-Distribution-Center
• Faulting application name: lsass.exe
• C:\Windows\System32\lsass.exe
• C:\Windows\System32\kdcsvc.dll
• C:\Windows\System32\kerberos.dll
• Windows Error Reporting
• TCP/88
• UDP/88
• TCP/464
• UDP/464

What your security team should do

• Prioritize patching domain controllers and Windows servers that provide Kerberos authentication before lower-risk member servers.
• Inventory all Windows Server 2012, 2016, 2019, 2022, and 2025 systems and confirm they are receiving the relevant Microsoft security updates.
• Restrict Kerberos exposure so TCP/UDP 88 and TCP/UDP 464 are reachable only from required trusted networks.
• Increase monitoring on domain controllers for Kerberos errors, LSASS instability, unexpected service restarts, and unusual authentication volumes from adjacent network segments.
• Hunt for signs of prior exploitation even if no public exploit is known, focusing on crashes or abnormal Kerberos traffic around the publication date and afterward.
• Ensure domain controller EDR policies preserve telemetry without destabilizing LSASS or Kerberos services.
• Review privileged credential exposure and domain controller hardening because successful exploitation could lead to high-impact authentication infrastructure compromise.
• Track Microsoft advisories for fixed build details and any change in exploit maturity, EPSS, or KEV status.