CVE-2025-26647
published 2025-04-08CVE-2025-26647: Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
PriorityP258high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
2.08%
79.5th percentile
Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.27670 | 6.1.7601.27670 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.23220 | 6.0.6003.23220 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.25423 | 6.2.9200.25423 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.22523 | 6.3.9600.22523 |
| microsoft | windows_server_2016 | < 10.0.14393.7969 | 10.0.14393.7969 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.7969 | 10.0.14393.7969 |
| microsoft | windows_server_2019 | < 10.0.17763.7136 | 10.0.17763.7136 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.7136 | 10.0.17763.7136 |
| microsoft | windows_server_2022 | < 10.0.20348.3453 | 10.0.20348.3453 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.3453 | 10.0.20348.3453 |
| microsoft | windows_server_2022_23h2 | < 10.0.25398.1551 | 10.0.25398.1551 |
| microsoft | windows_server_2025 | < 10.0.26100.3775 | 10.0.26100.3775 |
| microsoft | windows_server_2025 | >= 10.0.26100.0 < 10.0.26100.3775 | 10.0.26100.3775 |
| msrc | windows_server_2008_for_32-bit_systems_service_pack_2 | — | — |
| msrc | windows_server_2008_for_x64-based_systems_service_pack_2 | — | — |
| msrc | windows_server_2008_r2_for_x64-based_systems_service_pack_1 | — | — |
| msrc | windows_server_2012 | — | — |
| msrc | windows_server_2012_r2 | — | — |
| msrc | windows_server_2016 | — | — |
| msrc | windows_server_2019 | — | — |
| msrc | windows_server_2022 | — | — |
| msrc | windows_server_2022_23h2_edition | — | — |
| msrc | windows_server_2025 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for Kerberos TGT requests using certificates whose Subject Key Identifier (SKI) matches a target user but was issued by a CA not in the NTAuth store — this is the core exploit primitive for CVE-2025-26647. ↗
- →Enable and monitor Kerberos audit events in Audit mode on domain controllers to identify devices presenting certificates from CAs not in the NTAuth store — Microsoft explicitly recommends this as a detection step. ↗
- →Alert on privilege escalation attempts via Kerberos PKINIT or Certificate-based S4U delegation (RBKCD/KCD) flows where the certificate SKI maps to a high-privilege target account — these are the affected auth protocols. ↗
- →On patched DCs, monitor the AllowNtAuthPolicyBypass registry key under HKLM\SYSTEM\CurrentControlSet\Services\Kdc for unauthorized changes to value '2', which would re-expose the vulnerability. ↗
- →Attacker privilege escalation outcome is KDC granting elevated rights beyond what the certificate should authorize — look for Kerberos tickets issued with unexpected privilege levels relative to the certificate's intended scope. ↗
- ·The AllowNtAuthPolicyBypass registry key value of '2' (enforcement mode) is the security-hardened setting introduced by the CVE-2025-26647 patch; setting it to '1' is a temporary workaround that reduces protection. Environments should move to value '2' once all DCs are updated and non-NTAuth CAs are no longer in use. ↗
- ·The vulnerability specifically affects Windows Hello for Business (WHfB) Key Trust environments and Device Public Key Authentication (Machine PKINIT) deployments — these environments are at highest risk and should be prioritized for patching. ↗
- ·Enforcement mode (AllowNtAuthPolicyBypass=2) should only be enabled once the environment is no longer using certificates issued by CAs not present in the NTAuth store, per Microsoft's remediation guidance. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c4pv-p44r-9xfc: Improper input validation in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network
ghsa_unreviewed·2025-04-08
CVE-2025-26647 [HIGH] CWE-20 GHSA-c4pv-p44r-9xfc: Improper input validation in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network
Improper input validation in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.
Microsoft
Windows Kerberos Elevation of Privilege Vulnerability
vendor_msrc·2025-04-08·CVSS 8.8
CVE-2025-26647 [HIGH] CWE-20 Windows Kerberos Elevation of Privilege Vulnerability
Windows Kerberos Elevation of Privilege Vulnerability
Description: Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could be assigned much greater rights by the Key Distribution Center to the certificate than intended.
FAQ: How could an attacker exploit this vulnerability?
An authenticated attacker could exploit this vulnerability by obtaining a certificate containing the target Subject Key Identifier (SKI) value from a Certificate Authority (CA). The attacker could then use this certificate to get a Ticket Granting Ticket (TGT) for the target user from the Key Distribu
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Microsoft fixes Windows Server auth issues caused by April updates
blogs_bleepingcomputer·2025-06-11
Microsoft fixes Windows Server auth issues caused by April updates
## Microsoft fixes Windows Server auth issues caused by April updates
## Sergiu Gatlan
Microsoft has fixed a known issue causing authentication problems on Windows Server domain controllers after installing the April 2025 security updates.
Platforms affected by these problems include Windows Server 2016, Windows Server 2019, Windows Server 2022, and the latest version, Windows Server 2025.
However, as Microsoft further explained when it acknowledged this known issue in early May , home users are unlikely to be impacted since domain controllers are typically used in enterprise authentication scenarios.
"After installing the April Windows monthly security update released April 8, 2025 (KB5055523) or later, Active Directory Domain Controllers (DC) might experience issues when processing
Bleepingcomputer
Microsoft: April updates cause Windows Server auth issues
blogs_bleepingcomputer·2025-05-07·CVSS 8.8
[HIGH] Microsoft: April updates cause Windows Server auth issues
## Microsoft: April updates cause Windows Server auth issues
## Sergiu Gatlan
Microsoft says the April 2025 security updates are causing authentication issues on some Windows Server 2025 domain controllers.
The list of impacted platforms includes Windows Server 2016, Windows Server 2019, Windows Server 2022, and the latest version, Windows Server 2025.
However, as the company further explained, home users are unlikely to be affected by this known issue since domain controllers are typically used for business and enterprise authentication.
"After installing the April Windows monthly security update released April 8, 2025 (KB5055523) or later, Active Directory Domain Controllers (DC) might experience issues when processing Kerberos logons or delegations using certificate-based credentia
Qualys
Microsoft and Adobe Patch Tuesday, April 2025 Security Update Review | Qualys
blogs_qualys·2025-04-08
Microsoft and Adobe Patch Tuesday, April 2025 Security Update Review | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for April 2025
- Adobe Patches for April 2025
- Zero-day Vulnerabilities Patched in April Patch Tuesday Edition
- Critical Severity Vulnerabilities Patched in April Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
- Rapid Response withPatch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- Qualys Monthly Webinar Series
Microsoft’s April 2025 Patch Tuesday has arrived, delivering critical security updates and fixes across the various products, features, and roles. Here’s a quick breakdown of what you need to know.
## Microsoft Patch Tuesday for April 2025
In this m
Bleepingcomputer
Microsoft April 2025 Patch Tuesday fixes exploited zero-day, 134 flaws
blogs_bleepingcomputer·2025-04-08·CVSS 7.8
[HIGH] Microsoft April 2025 Patch Tuesday fixes exploited zero-day, 134 flaws
## Microsoft April 2025 Patch Tuesday fixes exploited zero-day, 134 flaws
## Lawrence Abrams
49 Elevation of Privilege Vulnerabilities
9 Security Feature Bypass Vulnerabilities
31 Remote Code Execution Vulnerabilities
17 Information Disclosure Vulnerabilities
14 Denial of Service Vulnerabilities
3 Spoofing Vulnerabilities
The above numbers do not include Mariner flaws and 13 Microsoft Edge vulnerabilities fixed earlier this month.
To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5055523 & KB5055528 cumulative updates and the Windows 10 KB5055518 update .
## One actively exploited zero-days
This month's Patch Tuesday fixes one actively exploited zero-day. Microsoft classifies a zero-day flaw as publicly disclos
Qualys
Microsoft and Adobe Patch Tuesday, April 2025 Security Update Review
blogs_qualys·2025-04-08
Microsoft and Adobe Patch Tuesday, April 2025 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for April 2025
Adobe Patches for April 2025
Zero-day Vulnerabilities Patched in April Patch Tuesday Edition
Critical Severity Vulnerabilities Patched in April Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
Rapid Response withPatch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
Qualys Monthly Webinar Series
Microsoft’s April 2025 Patch Tuesday has arrived, delivering critical security updates and fixes across the various products, features, and roles. Here’s a quick breakdown of what you need to know.
## Microsoft Patch Tuesday for April 2025
In this month’s Patch
Crowdstrike
April 2025 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] April 2025 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
2025-04-08
Published