CVE-2026-84001 Overview
CVE-2026-84001 is an out-of-bounds read vulnerability [CWE-125] in the Windows Key Distribution Center (KDC). An unauthenticated remote attacker can send crafted network requests to trigger the flaw and cause a denial of service. The vulnerability affects a broad range of Windows client and server releases, including Windows Server 2012 through Windows Server 2025 and Windows 10 and 11 client editions. Microsoft published the advisory on September 8, 2026.
Critical Impact
Successful exploitation disrupts Kerberos authentication services across an Active Directory domain, degrading availability of any workload that depends on the KDC for ticket issuance.
Affected Products
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
- Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2
- Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1
Discovery Timeline
- 2026-09-08 - CVE-2026-84001 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-84001
Vulnerability Analysis
The Key Distribution Center is the core Kerberos service on Windows domain controllers. It issues Ticket Granting Tickets (TGTs) and service tickets to authenticated principals. The vulnerability is an out-of-bounds read within KDC request processing. When the service parses a malformed Kerberos message, it reads memory beyond the intended buffer boundary. The read triggers an unhandled fault that terminates or destabilizes the service.
Because domain authentication depends on the KDC, an outage affects logon, service ticket issuance, and any Kerberos-protected resource across the domain. The advisory reports no impact to confidentiality or integrity, only availability.
Root Cause
The defect stems from missing or insufficient bounds validation on an attacker-controlled length or offset field in a Kerberos protocol structure. During parsing, the KDC dereferences data past the end of an allocated buffer, which classifies as [CWE-125] Out-of-Bounds Read.
Attack Vector
The attack requires network reachability to a domain controller on Kerberos ports, typically TCP and UDP 88. No authentication or user interaction is required. An attacker crafts a malformed Kerberos request, transmits it to the KDC, and induces service failure. Repeated requests sustain the denial-of-service condition. Public proof-of-concept code and in-the-wild exploitation have not been reported at publication time. See the Microsoft CVE-2026-84001 Update Guide for vendor technical detail.
Detection Methods for CVE-2026-84001
Indicators of Compromise
- Unexpected termination or repeated restarts of the kdcsvc service (lsass.exe hosting KDC) on domain controllers.
- Spikes in malformed Kerberos AS-REQ or TGS-REQ traffic on TCP/UDP port 88 from unauthenticated sources.
- Authentication failures across the domain correlated with KDC availability events in the System event log.
Detection Strategies
- Monitor Windows Event IDs related to Kerberos-Key-Distribution-Center source and LSASS crash events (Event ID 1000/1001) on domain controllers.
- Deploy network intrusion detection signatures that identify malformed ASN.1 structures in Kerberos requests reaching port 88.
- Correlate domain-wide authentication error bursts with domain controller health telemetry to surface DoS attempts.
Monitoring Recommendations
- Establish availability baselines for each domain controller's KDC service and alert on deviations.
- Ingest domain controller Security, System, and Kerberos operational logs into a centralized SIEM or data lake for correlation.
- Track inbound Kerberos traffic volumes and source diversity to detect anomalous request patterns.
How to Mitigate CVE-2026-84001
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-84001 Update Guide to all domain controllers.
- Prioritize patching of internet-exposed or perimeter-adjacent domain controllers first.
- Verify domain controller replication and Kerberos service health after each patch cycle.
Patch Information
Microsoft has published patches through the September 2026 security update cycle covering all listed Windows client and server versions. Refer to the Microsoft CVE-2026-84001 Update Guide for KB article numbers specific to each build.
Workarounds
- Restrict inbound Kerberos traffic (TCP/UDP 88) to trusted internal subnets using host and network firewalls.
- Ensure domain controllers are not reachable from untrusted networks, including the public internet.
- Enable automatic restart of the KDC/LSASS service dependencies where operationally acceptable to reduce outage duration until patching completes.
# Example: restrict Kerberos (port 88) to trusted management subnet on a Windows DC
New-NetFirewallRule -DisplayName "Kerberos-KDC-Restrict" `
-Direction Inbound -Protocol TCP -LocalPort 88 `
-RemoteAddress 10.0.0.0/8 -Action Allow
New-NetFirewallRule -DisplayName "Kerberos-KDC-Restrict-UDP" `
-Direction Inbound -Protocol UDP -LocalPort 88 `
-RemoteAddress 10.0.0.0/8 -Action Allow
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
