CVE-2026-69760: Windows Kerberos DOS Vulnerability

CVE-2026-69760 Overview

CVE-2026-69760 is an out-of-bounds read vulnerability [CWE-125] in the Windows Kerberos authentication component. An unauthenticated attacker can trigger the flaw over the network to cause a denial-of-service condition against the affected Kerberos service. Microsoft published the advisory on September 8, 2026.

The vulnerability requires no privileges and no user interaction. Because Kerberos is central to Windows authentication, disruption can prevent domain logons, ticket issuance, and dependent services across an Active Directory environment.

Critical Impact
Remote, unauthenticated attackers can crash or hang the Windows Kerberos service, disrupting authentication across a domain and blocking access to dependent enterprise services.

Affected Products

Microsoft Windows (Kerberos component) — refer to the Microsoft advisory for the full list of affected builds
Windows Server editions running the Kerberos Key Distribution Center (KDC) role
Domain-joined Windows clients that process Kerberos responses

Discovery Timeline

2026-09-08 - CVE-2026-69760 published to NVD
2026-09-08 - Microsoft published the Microsoft CVE-2026-69760 Vulnerability Update
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-69760

Vulnerability Analysis

The vulnerability is an out-of-bounds read within Windows Kerberos message parsing. When the affected component processes a specially crafted Kerberos protocol message, it reads memory beyond the intended buffer boundary. The invalid read triggers an exception or corrupts internal state, terminating the Kerberos service and denying authentication to network clients.

Because the attack vector is network-based and requires no authentication, an adversary with the ability to send packets to a Kerberos endpoint (typically UDP/TCP port 88) can trigger the condition. The impact is limited to availability; confidentiality and integrity are not affected according to the advisory.

Domain controllers are the primary target. Loss of KDC availability cascades quickly, blocking Ticket Granting Ticket (TGT) issuance, service ticket requests, and downstream applications that rely on Kerberos for single sign-on.

Root Cause

The root cause is missing or incorrect bounds validation when parsing untrusted Kerberos protocol input. The affected code path reads past the end of an allocated buffer, an issue classified under [CWE-125] (Out-of-bounds Read). Microsoft's advisory is the authoritative source for the affected function and fix details.

Attack Vector

An unauthenticated remote attacker sends a malformed Kerberos message to a listener on the target system. Repeated exploitation can produce a sustained denial-of-service condition against domain authentication.

See the Microsoft CVE-2026-69760 Vulnerability Update for protocol-level specifics. No public proof-of-concept exploit is currently listed for this CVE.

Detection Methods for CVE-2026-69760

Indicators of Compromise

Unexpected crashes, restarts, or hangs of the lsass.exe process or Kerberos-related services on domain controllers
Windows Event Log entries indicating Kerberos KDC service termination or repeated application faults
Spikes in malformed Kerberos traffic to TCP/UDP port 88 from untrusted sources

Detection Strategies

Monitor domain controllers for authentication failures correlated with KDC service interruptions
Inspect network telemetry for abnormally large or malformed Kerberos AS-REQ, TGS-REQ, and AP-REQ messages
Alert on repeated Kerberos protocol errors originating from a single source address within a short time window

Monitoring Recommendations

Collect and centralize Windows Security, System, and Application event logs from all domain controllers
Baseline normal Kerberos traffic volume and flag deviations that coincide with service degradation
Track availability of KDC endpoints with active health checks and page on sustained failures

How to Mitigate CVE-2026-69760

Immediate Actions Required

Apply Microsoft's security update for CVE-2026-69760 to all domain controllers and affected Windows systems as a priority
Restrict inbound access to Kerberos port 88 so only trusted internal networks can reach domain controllers
Ensure redundant domain controllers are patched and available to preserve authentication during rollout

Patch Information

Microsoft has released a security update addressing CVE-2026-69760. Consult the Microsoft CVE-2026-69760 Vulnerability Update for the specific KB articles and build numbers that correspond to each supported Windows version. Deploy the update through Windows Update, WSUS, or your configuration management platform following standard change control.

Workarounds

No official workaround replaces patching; network segmentation and firewall rules limiting exposure of port 88 reduce the attack surface
Enforce strict perimeter controls so external networks cannot reach internal KDC listeners
Monitor for KDC service failures and configure automatic service recovery to reduce downtime while patches are staged

bash

# Example: restrict Kerberos (port 88) exposure on a Windows host to trusted subnets
New-NetFirewallRule -DisplayName "Restrict Kerberos TCP 88" `
  -Direction Inbound -Protocol TCP -LocalPort 88 `
  -RemoteAddress 10.0.0.0/8 -Action Allow

New-NetFirewallRule -DisplayName "Restrict Kerberos UDP 88" `
  -Direction Inbound -Protocol UDP -LocalPort 88 `
  -RemoteAddress 10.0.0.0/8 -Action Allow