CVE-2026-84001

CVE-2026-84001 is an out-of-bounds read (CWE-125) in the Windows Key Distribution Center (KDC), the Kerberos authentication component built into Windows. An unauthorized, remote attacker can trigger it by sending specially crafted network requests to the KDC service, causing the service to read beyond allocated memory. According to the CVSS vector, the impact is availability-only (C:N/I:N/A:H): the attacker gains denial of service, not code execution, data theft, or tampering, though taking down the KDC on domain controllers can disrupt Kerberos authentication for an entire Active Directory domain. Any Windows system running the KDC is affected, chiefly Windows domain controllers and servers, although the specific affected Windows version ranges are not enumerated in the available data. There is no known public proof-of-concept, the CVE is not in CISA's KEV catalog, and its EPSS probability of ~0.6% suggests exploitation risk is currently low; the fix shipped in Microsoft's September 2026 Patch Tuesday release.

What to do: Apply the September 2026 Microsoft security updates (which include the fix for CVE-2026-84001) to all Windows systems, prioritizing domain controllers given the domain-wide availability impact if a KDC is taken down. As an interim mitigation, restrict unauthenticated reachability to Kerberos (TCP/UDP 88) on domain controllers from untrusted or internet-facing networks. With no known PoC or in-the-wild exploitation and modest EPSS, patching within your normal Patch Tuesday cycle is reasonable, but do not defer fixes on critical DCs.