CVE-2014-6324

CVE-2014-6324 is a privilege escalation flaw in the Kerberos Key Distribution Center (KDC) on Microsoft domain controllers: a remote, authenticated domain user sends specially crafted Kerberos ticket data that the KDC fails to validate correctly, allowing the attacker to obtain domain administrator privileges. An attacker who already holds any valid domain credentials can therefore escalate to full control of the Active Directory domain, which typically means compromise of every domain controller and every account in the forest. Any organization running Active Directory on Windows domain controllers is affected; the provided data does not enumerate specific Windows versions or the fixed release. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25, ransomware use unknown), carries a 87.4% EPSS probability of exploitation within 30 days (100th percentile), and is publicly associated in security reporting with the Duqu 2.0 espionage platform.

What to do: Apply the Microsoft security update for this vulnerability (MS14-068, November 2014) per vendor instructions on every domain controller, and verify no unpatched DC remains, since one vulnerable domain controller is enough for any domain user to become domain administrator. Prioritize internet-exposed and domain-controller assets in CISA KEV-driven patch tracking, and monitor Kerberos ticket traffic for anomalous or forged ticket/PAC content while patching is pending.