PatchaPalooza

CVE-2025-26647: Windows Kerberos Elevation of Privilege Vulnerability

CVE-2025-26647 is an elevation of privilege vulnerability in Windows Kerberos, rated Important by Microsoft, with a CVSS 3.1 base score of 8.8 (High). An attacker can exploit it remotely over the network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 2.30% probability of exploitation activity in the next 30 days, higher than 84% of all scored vulnerabilities. Microsoft released the fix on 7 April 2025 in the April 2025 Patch Tuesday, delivered through 11 security updates (KB5055519, KB5055526, KB5055523, KB5055527 and more). It affects 19 products in 2 product families (Windows, ESU).

Key facts

CVE ID
CVE-2025-26647
Severity
High CVSS 8.8
Microsoft severity
Important
Impact
Elevation of Privilege
Exploited in the wild
No
Publicly disclosed
No
Exploitation likelihood
Less Likely
Weakness
CWE-20
EPSS
2.30% (percentile 84%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
April 2025 Patch Tuesday
Product families
Windows, ESU

CVSS score and vector

Microsoft scores CVE-2025-26647 at 8.8 (temporal 7.7) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

MetricValue
Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit code maturityUnproven
Remediation levelOfficial fix
Report confidenceConfirmed

Description

Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network.

Frequently asked questions (Microsoft)

What privileges could be gained by an attacker who successfully exploited the vulnerability?

An attacker who successfully exploited this vulnerability could be assigned much greater rights by the Key Distribution Center to the certificate than intended.

How could an attacker exploit this vulnerability?

An authenticated attacker could exploit this vulnerability by obtaining a certificate containing the target Subject Key Identifier (SKI) value from a Certificate Authority (CA). The attacker could then use this certificate to get a Ticket Granting Ticket (TGT) for the target user from the Key Distribution Center (KDC).

Mitigations and workarounds

To help protect your environment and prevent outages, we recommend the following steps:

  • UPDATE all Windows computers and domain controllers with a Windows update released on or after April 8, 2025.
  • MONITOR audit events that will be visible in Audit mode to identify all devices that are not updated.
  • ENABLE Enforcement mode once your environment is no longer using certificates issued by authorities that are not in the NTAuth store.

For more information, please review: https://support.microsoft.com/help/5057784.

Affected products (19)

Windows

ProductSecurity updateTypeFixed buildRestart
Windows Server 2019KB5055519Security Update10.0.17763.7136Yes
Windows Server 2019 (Server Core installation)KB5055519Security Update10.0.17763.7136Yes
Windows Server 2022KB5055526Security Update10.0.20348.3453Yes
Windows Server 2022 (Server Core installation)KB5055526Security Update10.0.20348.3453Yes
Windows Server 2025 (Server Core installation)KB5055523Security Update10.0.26100.3775Yes
Windows Server 2022, 23H2 Edition (Server Core installation)KB5055527Security Update10.0.25398.1551Yes
Windows Server 2025KB5055523Security Update10.0.26100.3775Yes
Windows Server 2016KB5055521Security Update10.0.14393.7969Yes
Windows Server 2016 (Server Core installation)KB5055521Security Update10.0.14393.7969Yes

ESU

ProductSecurity updateTypeFixed buildRestart
Windows Server 2008 for 32-bit Systems Service Pack 2KB5055609
KB5055596		Monthly Rollup
Security Only		6.0.6003.23220
6.0.6003.23220		Yes
Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)KB5055609
KB5055596		Monthly Rollup
Security Only		6.0.6003.23220
6.0.6003.23220		Yes
Yes
Windows Server 2008 for x64-based Systems Service Pack 2KB5055609
KB5055596		Monthly Rollup
Security Only		6.0.6003.23220
6.0.6003.23220		Yes
Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)KB5055609
KB5055596		Monthly Rollup
Security Only		6.0.6003.23220
6.0.6003.23220		Yes
Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1KB5055561
KB5055570		Monthly Rollup
Security Only		6.1.7601.27670
6.1.7601.27670		Yes
Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)KB5055561
KB5055570		Monthly Rollup
Security Only		6.1.7601.27670
6.1.7601.27670		Yes
Yes
Windows Server 2012KB5055581Monthly Rollup6.2.9200.25423Yes
Windows Server 2012 (Server Core installation)KB5055581Monthly Rollup6.2.9200.25423Yes
Windows Server 2012 R2KB5055557Monthly Rollup6.3.9600.22523Yes
Windows Server 2012 R2 (Server Core installation)KB5055557Monthly Rollup6.3.9600.22523Yes

Security updates (11)

NIST NVD data

NVD status
Modified
NVD CVSS
8.8 (HIGH)
NVD weakness
CWE-20
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
windows server 2008 (x64)all listed versions
windows server 2008 (x86)all listed versions
windows server 2008 r2 (x64)all listed versions
windows server 2012all listed versions
windows server 2012 r2all listed versions
windows server 2016before 10.0.14393.7969
windows server 2019before 10.0.17763.7136
windows server 2022before 10.0.20348.3453
windows server 2022 23h2before 10.0.25398.1551
windows server 2025before 10.0.26100.3775

References

Acknowledgments

Revision history

VersionDateDescription
1.0Information published.
1.1Updated FAQ information. This is an informational change only.

Sources