CVE-2026-69676

CVE-2026-69676 is a capture-replay authentication bypass (CWE-294) in the Windows Kerberos implementation, disclosed by Microsoft as part of the September 2026 Patch Tuesday. An attacker who is already authorized (low-privilege credentials) can replay captured authentication material over the network to bypass authentication checks. Successful exploitation results in remote code execution, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score of 8.8). Any organization running Windows in an Active Directory environment is potentially affected, since Kerberos is the default authentication protocol for Windows domains. As of this analysis there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a ~1.2% chance of exploitation within 30 days, though it shipped in a record-sized Patch Tuesday release alongside two actively exploited zero-days.

What to do: Apply Microsoft's September 2026 Windows security updates as soon as possible, prioritizing domain controllers, DHCP/DNS servers, and other Kerberos-reliant infrastructure. Review network segmentation and monitor for replayed-ticket anomalies; network defenders can also enable the Snort detection rules published alongside this Patch Tuesday. Confirm applicability against Microsoft's advisory, since the affected version ranges were not enumerated in the available data.