CVE-2026-69744: Windows Kerberos DoS Vulnerability

CVE-2026-69744 Overview

CVE-2026-69744 is a null pointer dereference vulnerability in the Windows Kerberos authentication component. An unauthenticated remote attacker can trigger the flaw over the network to cause a denial-of-service condition on affected systems. The weakness is tracked under CWE-476: NULL Pointer Dereference and requires no user interaction or prior privileges to exploit.

Microsoft published the advisory through the Microsoft Security Response Center. Successful exploitation impacts availability of the Kerberos service, which underpins domain authentication across Windows environments.

Critical Impact
Remote, unauthenticated attackers can disrupt Kerberos authentication services, potentially blocking domain logons and Kerberos-dependent applications across an enterprise.

Affected Products

Windows Kerberos (Microsoft Windows operating systems, per Microsoft advisory)
Specific affected builds are enumerated in the Microsoft Security Update CVE-2026-69744 guide
Domain controllers and any Windows hosts exposing Kerberos services are within scope

Discovery Timeline

2026-09-08 - CVE-2026-69744 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-69744

Vulnerability Analysis

The vulnerability resides in the Windows Kerberos implementation, which handles authentication requests using tickets issued by a Key Distribution Center (KDC). A specially crafted network message causes Kerberos to dereference a null pointer during request processing. The dereference terminates the affected service path, producing a denial-of-service condition.

Because the flaw is reachable across the network without credentials or user interaction, any host exposing Kerberos endpoints is a candidate target. Domain controllers face the highest operational risk because they broker authentication for the entire Active Directory forest. An outage of Kerberos disrupts single sign-on, service ticket issuance, and Kerberos-authenticated applications such as SMB, LDAP, and HTTP with Negotiate authentication.

The CWE-476 classification indicates the code path fails to validate a pointer before use. Attackers exploit this class of bug by supplying inputs that steer control flow into a state where the expected object was never allocated or was released early. The EPSS score for CVE-2026-69744 is 1.15% at the 65th percentile as of 2026-09-10.

Root Cause

The defect stems from missing validation of a pointer within the Kerberos request-handling logic. When the referenced object is absent, the code proceeds to dereference the pointer and crashes the execution context. Microsoft has not published detailed root-cause internals beyond the advisory.

Attack Vector

Exploitation occurs over the network against a listening Kerberos service, typically on TCP or UDP port 88. The attacker sends a malformed authentication message that triggers the null dereference. No authentication or user interaction is required, and the attack complexity is low.

No public proof-of-concept exploit is available at publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update CVE-2026-69744 guide for protocol-level detail.

Detection Methods for CVE-2026-69744

Indicators of Compromise

Unexpected termination or restart of the Kerberos service (lsass.exe faults) on domain controllers
Spikes in Kerberos authentication failures across the environment following a malformed request
Windows Error Reporting entries citing null pointer access violations within Kerberos modules

Detection Strategies

Monitor Windows Event Log for Service Control Manager events indicating Kerberos or LSASS crashes and restarts
Inspect network telemetry for anomalous or malformed traffic to TCP/UDP port 88 originating from untrusted networks
Correlate authentication failure surges with host-level crash events to identify triggered exploitation attempts

Monitoring Recommendations

Alert on repeated lsass.exe fault events across domain controllers within a short time window
Track availability metrics for KDC services and generate alerts when authentication throughput drops sharply
Ingest domain controller Security and System logs into a centralized analytics platform for cross-host correlation

How to Mitigate CVE-2026-69744

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-69744 guide to all affected Windows systems, prioritizing domain controllers
Restrict inbound access to Kerberos ports (TCP/UDP 88) from untrusted networks using host and perimeter firewalls
Validate domain controller redundancy so a single crash does not eliminate authentication capacity

Patch Information

Microsoft has released updates addressing CVE-2026-69744. Consult the Microsoft Security Update CVE-2026-69744 guide for the applicable KB articles and per-product build numbers. Deploy the update through Windows Update, WSUS, or your endpoint management tooling.

Workarounds

Limit Kerberos exposure to trusted network segments using network segmentation and firewall rules
Monitor and rate-limit anomalous traffic to KDC endpoints where perimeter controls support it
Maintain rapid restart and failover procedures for domain controllers to reduce downtime if exploitation occurs

bash

# Example: restrict inbound Kerberos (port 88) on a Windows host to trusted subnets
New-NetFirewallRule -DisplayName "Restrict Kerberos TCP 88" `
  -Direction Inbound -Protocol TCP -LocalPort 88 `
  -RemoteAddress 10.0.0.0/8 -Action Allow

New-NetFirewallRule -DisplayName "Block Kerberos TCP 88 Other" `
  -Direction Inbound -Protocol TCP -LocalPort 88 `
  -Action Block