CVE-2025-27479 Overview
CVE-2025-27479 is a denial of service vulnerability in the Windows Kerberos authentication subsystem. The flaw stems from an insufficient resource pool ([CWE-410]) that can be exhausted by an unauthenticated attacker over the network. Successful exploitation disrupts Kerberos authentication services on affected Windows Server hosts, preventing legitimate users from authenticating to domain resources.
Microsoft published the advisory on April 8, 2025. The vulnerability affects every supported Windows Server release from Windows Server 2012 through Windows Server 2025, including 23H2. The Exploit Prediction Scoring System (EPSS) places this issue in the 97th percentile, indicating a relatively elevated likelihood of exploitation activity compared to typical CVEs.
Critical Impact
An unauthenticated remote attacker can exhaust Kerberos resources on domain controllers, halting authentication services across an Active Directory environment.
Affected Products
- Microsoft Windows Server 2012 and 2012 R2
- Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2
- Microsoft Windows Server 2025
Discovery Timeline
- 2025-04-08 - CVE-2025-27479 published to NVD
- 2025-04-08 - Microsoft released security advisory and patch
- 2025-07-08 - Last updated in NVD database
Technical Details for CVE-2025-27479
Vulnerability Analysis
The vulnerability resides in the Windows Kerberos Key Distribution Center (KDC) implementation. Kerberos handles authentication ticket requests through a finite pool of internal resources used to process Authentication Service (AS) and Ticket Granting Service (TGS) exchanges. The vulnerable code path does not adequately bound or recycle these resources when handling incoming requests.
An attacker who sends a sustained volume of crafted Kerberos requests can drive the resource pool to exhaustion. Once exhausted, the KDC stops servicing legitimate authentication traffic. Because Kerberos underpins domain logons, file share access, service-to-service authentication, and most Active Directory operations, the impact propagates across dependent workloads.
The flaw requires no privileges, no user interaction, and is reachable across the network through standard Kerberos ports (TCP/UDP 88).
Root Cause
The root cause is mapped to [CWE-410]: Insufficient Resource Pool. The KDC allocates state for inbound authentication requests without enforcing limits proportional to capacity. Lack of bounded queuing, request prioritization, or aggressive timeout handling allows attacker traffic to consume resources reserved for legitimate clients.
Attack Vector
The attack vector is purely network-based. An attacker with reachability to a domain controller's Kerberos service sends a high rate of authentication requests to deplete the resource pool. No valid credentials are required because the resource consumption occurs during the early phases of request processing, before authentication completes.
Refer to the Microsoft CVE-2025-27479 Advisory for vendor-specific technical context.
Detection Methods for CVE-2025-27479
Indicators of Compromise
- Sudden spikes in inbound traffic to TCP/UDP port 88 on domain controllers from a narrow set of source addresses.
- Elevated Kerberos error events such as 4771 (Kerberos pre-authentication failed) and 4768 (TGT requested) at abnormal volumes.
- Domain controller performance counters showing saturation of LSASS or Kerberos-related thread pools.
- Authentication failures reported by downstream services that cannot reach a KDC.
Detection Strategies
- Baseline normal Kerberos request volume per domain controller and alert on statistical deviations.
- Correlate Windows Security Event Log Kerberos events with network telemetry on port 88 to identify request floods.
- Monitor LSASS CPU and handle counts for sustained anomalies on domain controllers.
Monitoring Recommendations
- Forward domain controller Security and System logs to a centralized analytics platform for anomaly detection.
- Track KDC service availability with synthetic Kerberos authentication probes from multiple network segments.
- Enable NetFlow or equivalent telemetry on segments hosting domain controllers to detect volumetric authentication traffic.
How to Mitigate CVE-2025-27479
Immediate Actions Required
- Apply the Microsoft April 2025 security update to all affected Windows Server systems, prioritizing domain controllers.
- Inventory all domain controllers and Read-Only Domain Controllers to confirm patch coverage across forests and trusts.
- Restrict network exposure of Kerberos services so only trusted client subnets can reach TCP/UDP port 88 on KDCs.
Patch Information
Microsoft released fixes through the April 8, 2025 Patch Tuesday cycle. Updates are available for Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025. Consult the Microsoft CVE-2025-27479 Advisory for specific KB article numbers and build numbers per platform.
Workarounds
- Place domain controllers behind firewalls that enforce rate limiting on Kerberos ports where supported.
- Distribute authentication load across additional domain controllers to increase capacity headroom while patches are deployed.
- Segment management and client networks to reduce the population of hosts able to reach KDCs directly.
# Example: verify installed update on a Windows Server domain controller
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# Example: confirm Kerberos service health
nltest /dsgetdc:<your.domain> /kdc
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
