CVE-2025-21350 Overview
CVE-2025-21350 is a denial of service vulnerability affecting the Windows Kerberos authentication component across multiple Microsoft Windows client and server editions. The flaw allows a network-based attacker to disrupt Kerberos service availability without requiring authentication or user interaction. Microsoft published the advisory on February 11, 2025, and it received a CVSS 3.1 score of 5.9. The weakness is categorized under [CWE-20] Improper Input Validation. Successful exploitation impacts availability of the Kerberos service, which is central to Active Directory authentication in enterprise environments.
Critical Impact
A remote attacker can trigger a denial of service in the Windows Kerberos service, disrupting authentication across affected Windows clients and Active Directory domain controllers.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-02-11 - CVE-2025-21350 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21350
Vulnerability Analysis
CVE-2025-21350 resides in the Windows Kerberos implementation, the authentication protocol used by Windows domains for verifying identity of users and services. The vulnerability is classified as improper input validation under [CWE-20]. An unauthenticated attacker on the network can send specially crafted Kerberos protocol traffic that causes the Kerberos service to fail, resulting in denial of service. Because Kerberos underpins domain authentication, disruption on a domain controller can prevent legitimate users and services from authenticating.
The EPSS score of 2.067% (79th percentile) reflects a relatively elevated exploitation probability compared with typical Windows advisories, though no public exploit code is available and the vulnerability is not listed in the CISA KEV catalog.
Root Cause
Microsoft has not released full technical internals, but the [CWE-20] classification indicates the Kerberos service does not adequately validate specific fields in incoming protocol messages. Malformed input reaches processing logic that cannot handle it safely, triggering a fault condition in the service.
Attack Vector
The attack vector is network-based and does not require credentials or user interaction, though attack complexity is high. An attacker needs the ability to reach Kerberos endpoints, typically TCP/UDP port 88 on domain controllers or clients accepting Kerberos requests. The high complexity indicates the attacker must meet specific timing or configuration conditions to reliably trigger the fault. No public proof-of-concept has been released.
No verified exploit code is available for this vulnerability. Refer to the Microsoft Security Update Guide for CVE-2025-21350 for authoritative technical details.
Detection Methods for CVE-2025-21350
Indicators of Compromise
- Unexpected termination or repeated restarts of the Kerberos Key Distribution Center (kdcsvc) service on domain controllers.
- Spikes in Kerberos authentication failures (Event IDs 4771, 4768) or clients falling back to NTLM.
- Malformed or oversized Kerberos AS-REQ or TGS-REQ packets targeting port 88.
- Sudden loss of domain authentication availability across multiple endpoints simultaneously.
Detection Strategies
- Monitor Windows Event Log for KDC service crashes, Service Control Manager restart events, and application faults referencing lsass.exe or Kerberos modules.
- Deploy network signatures on IDS/IPS platforms to flag malformed Kerberos packets on TCP/UDP 88.
- Correlate authentication failure volume against baseline traffic to detect denial-of-service conditions in progress.
Monitoring Recommendations
- Track availability of domain controllers with synthetic Kerberos authentication probes at short intervals.
- Alert on any restart of Kerberos-related services or unexpected crashes of lsass.exe.
- Aggregate authentication telemetry from all domain controllers to identify coordinated attempts against the Kerberos service.
How to Mitigate CVE-2025-21350
Immediate Actions Required
- Apply the February 2025 Microsoft security updates to all affected Windows client and server versions, prioritizing Active Directory domain controllers.
- Inventory exposed Kerberos endpoints and confirm port 88 is not reachable from untrusted networks or the internet.
- Validate patch deployment status across all Windows Server 2008 through Windows Server 2025 systems and Windows 10/11 clients.
Patch Information
Microsoft released fixes as part of the February 2025 Patch Tuesday cycle. Consult the Microsoft Security Update Guide for CVE-2025-21350 for the specific KB article associated with each affected Windows build.
Workarounds
- Restrict inbound Kerberos traffic (TCP/UDP 88) to authorized subnets using host and perimeter firewalls.
- Segment domain controllers into a management network reachable only by domain-joined hosts.
- Enable rate limiting and anomaly detection on network devices in front of domain controllers to reduce exposure until patches are applied.
# Restrict Kerberos traffic to trusted subnet on a Windows host
New-NetFirewallRule -DisplayName "Restrict Kerberos TCP 88" `
-Direction Inbound -Protocol TCP -LocalPort 88 `
-RemoteAddress 10.0.0.0/8 -Action Allow
New-NetFirewallRule -DisplayName "Block Kerberos TCP 88 - Other" `
-Direction Inbound -Protocol TCP -LocalPort 88 `
-Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
