CVE-2026-62773 Overview
CVE-2026-62773 is a use-after-free vulnerability [CWE-416] in the Windows Kerberos authentication component. An authorized local attacker can exploit the flaw to elevate privileges on the affected system. The vulnerability affects a broad range of Microsoft Windows client and server operating systems, including Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Microsoft published a security advisory addressing the issue.
Critical Impact
Successful exploitation grants an attacker elevated privileges on the local host, with high impact to confidentiality, integrity, and availability.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-62773 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-62773
Vulnerability Analysis
The vulnerability resides in the Windows Kerberos implementation, which handles authentication for domain and local accounts. A use-after-free condition occurs when the component references memory that has already been freed. An authorized local attacker who successfully manipulates the affected code path can corrupt memory in a privileged context. The result is local elevation of privilege on the target host.
The issue is tracked under CWE-416: Use After Free. Attack complexity is high, indicating that exploitation requires specific timing or state conditions rather than a straightforward call sequence. The attacker must already possess valid low-privileged credentials on the target system.
Root Cause
The root cause is improper lifetime management of a memory object within the Kerberos component. Code paths continue to reference a pointer after the underlying object is released, enabling an attacker to influence the contents of the reused allocation. Microsoft has not publicly disclosed the specific function or object involved. Refer to the Microsoft Security Update CVE-2026-62773 advisory for vendor-supplied details.
Attack Vector
Exploitation requires local access with existing low-privilege authentication to the target. No user interaction is required. An attacker triggers the vulnerable code path in Kerberos, races or grooms the heap to occupy the freed allocation with controlled data, and leverages the dangling reference to execute code or manipulate objects in a privileged context. Successful exploitation elevates the attacker to a higher privilege level on the host.
No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication.
Detection Methods for CVE-2026-62773
Indicators of Compromise
- Unexpected crashes or restarts of lsass.exe or Kerberos-related subsystems on affected hosts.
- Windows Error Reporting entries citing access violations in Kerberos modules such as kerberos.dll.
- Local user accounts spawning processes or accessing resources that require SYSTEM-level privileges.
Detection Strategies
- Monitor process integrity level transitions where a medium-integrity process spawns a high or SYSTEM-integrity child without a corresponding elevation prompt.
- Correlate Security event IDs 4672 (special privileges assigned) and 4688 (process creation) to identify anomalous privilege assignments tied to interactive user sessions.
- Alert on kernel-mode or LSASS memory access violations recorded in Application and System event logs.
Monitoring Recommendations
- Ingest Windows Security, System, and Application logs into a centralized SIEM for correlation across endpoints.
- Baseline expected Kerberos ticket-granting activity per host and flag deviations, particularly local privilege changes following authentication events.
- Enable Attack Surface Reduction rules and audit LSASS access to detect tooling frequently paired with local privilege escalation exploits.
How to Mitigate CVE-2026-62773
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-62773 advisory to all affected Windows client and server systems.
- Prioritize patching on multi-user systems, jump hosts, and domain-joined servers where local low-privileged access is broadly available.
- Audit local and domain account inventories to remove unnecessary interactive logon rights.
Patch Information
Microsoft has released security updates addressing CVE-2026-62773 for all listed Windows 10, Windows 11, and Windows Server versions. Consult the vendor advisory for the specific KB numbers corresponding to each supported build. Apply updates through Windows Update, WSUS, Microsoft Update Catalog, or your standard patch management tooling.
Workarounds
- No vendor-supplied workaround is currently documented; patching is the required remediation.
- Restrict interactive and remote interactive logon rights to trusted administrative accounts until updates are deployed.
- Enforce application allowlisting and Credential Guard to limit an attacker's ability to stage local exploitation tooling.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
