Windows Kerberos: Elevation of privilege due to weak authentication

Summary

A weakness in the Windows Kerberos authentication component allows an attacker who already holds a valid account to elevate privileges over the network. Exploitation requires high privileges and has high attack complexity, and the scope changes, so the impact can reach beyond the vulnerable component. The CVSS 3.1 base score is 8.0 (High), with high impact on confidentiality, integrity and availability. NVD analysis was still pending at the time of publication.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2: builds before 10.0.26100.9974
• Windows 11 Version 25H2: builds before 10.0.26200.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows 11 Version 26H2: builds before 10.0.26300.9974
• Windows Server 2022: builds before 10.0.20348.5870

Fixed in

• Per the CVE record, the fixed builds are the upper bounds listed above (for example 10.0.19044.7846 for Windows 10 21H2).
• Not yet confirmed against the MSRC advisory. A third-party tracker links the November 2026 cumulative update KB5131096 to Windows 10 21H2; inclusion of this CVE in that update is unverified.

Workaround

Unknown. No vendor-documented workaround was found.

Exploitation

• Public exploitation: Unknown. A third-party tracker lists the CVE as not exploited, but this is unconfirmed.
• CISA KEV listing: Unknown; not checked against the catalog.
• Public proof of concept: Unknown; no PoC was found in initial searches.

Our recommendation

• Verify the affected and fixed builds in the MSRC Security Update Guide before patching.
• Install the November 2026 cumulative update on domain controllers and other Windows servers first, then on clients.
• Restrict and monitor privileged accounts, and separate administrative tiers, since an attacker needs high privileges.
• Check the CISA KEV catalog and public PoC sources regularly until the NVD entry is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-122164 msrc.microsoft.com
• Strix CVE record CVE-2026-122164 www.strix.ai
• Senserva KB5131096 (November 2026 update) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:52.