CVE-2026-20833

—

CVSS 3.1

5.5 medium

EPSS

<1%p43

Published

Jan 13, 2026 (Jan 13, 2026)

Modified

Jun 17, 2026

Description

Use of a broken or risky cryptographic algorithm in Windows Kerberos allows an authorized attacker to disclose information locally.

Vendors: microsoft
Products: windows server 2008, windows server 2012, windows server 2016, windows server 2019, windows server 2022, windows server 2022 23h2, windows server 2025
Weakness: CWE-327
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news1 stories

Samba 4.24.0 ships Kerberos hardening and a CVE fix for domain encryption defaults

Help Net SecurityMar 19, 00:00 UTC · Mar 19, 2026Vulnerability CVE-2026-20833

35