CVE-2026-69760

CVE-2026-69760 is an out-of-bounds read (CWE-125) in the Kerberos implementation shipped with Microsoft Windows. It is triggered by unauthenticated network traffic — an attacker does not need credentials, privileges, or user interaction, and can likely provoke the flaw by sending malformed Kerberos protocol messages to a system running the affected service. Successful exploitation results in a denial of service: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates high availability impact with no confidentiality or integrity loss, and no evidence of remote code execution. Any Windows system running the affected Kerberos component is affected, with domain controllers and other servers accepting Kerberos authentication being the most critical targets. As of this analysis there is no known public proof of concept, the flaw is not in CISA's KEV, and EPSS assigns a modest ~1.1% probability of exploitation within 30 days (65th percentile).

What to do: Apply the Windows security update Microsoft assigns to CVE-2026-69760 for each affected Windows version (specific version ranges/KBs are in Microsoft's advisory, not this data). Until patched, restrict untrusted network access to Kerberos endpoints (TCP/UDP 88) — especially domain controllers and internet-facing or partner-facing authentication servers — and review event logs for KDC/Lsass crashes or unexpected service restarts. Given no known exploitation or public PoC, patching can be prioritized against other criticals, but exposed authentication infrastructure should be updated first.