# Windows Kerberos security feature bypass, impersonate the KDC

Source: https://startwithidentity.com/cves/cve-2024-20674/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

Windows Kerberos let an unauthenticated attacker on the network impersonate the Kerberos server (security feature bypass). Machine-in-the-middle, no prior account. CVSS 8.8. Microsoft patched it on 9 January 2024.

## Why it matters

If you can impersonate the KDC, you can issue tickets. That is domain identity, not a workstation bug. Read it as the start of the 2024-2026 Kerberos train: [PAC validation](https://startwithidentity.com/cves/cve-2024-26248/), [PKINIT](https://startwithidentity.com/cves/cve-2025-26647/), [CheckSum](https://startwithidentity.com/cves/cve-2025-60704/), [KerberLoss](https://startwithidentity.com/cves/cve-2026-25177/).

## What to do

- Deploy January 2024 updates on DCs and on members that speak Kerberos.
- Prefer SMB signing and channel binding so a forged KDC conversation is harder to land.
- Watch for unexpected KDC referrals and TGT requests that do not match your DC inventory.

## After you patch

Active Directory compromise is not contained by patching, because the artifacts an attacker creates outlive the vulnerability.

- **Rotate the krbtgt account twice**, with the replication interval between rotations, if there is any indication of ticket forgery. One rotation is not enough.
- **Audit AD CS certificate templates** for enrolment and enrollee-supplied-subject permissions, which are the most common escalation path left behind. See [certificate lifecycle](https://startwithidentity.com/glossary/certificate-lifecycle/).
- **Review privileged group membership and delegation rights** (Domain Admins, DnsAdmins, constrained and resource-based constrained delegation) for changes during the window.
- **Hunt for tickets with anomalous lifetimes or encryption types**, and for authentications to services that identity never touches.
- **Treat any issued certificate as a durable credential**: revoking a user's password does not revoke a certificate that authenticates as them. See [privilege escalation](https://startwithidentity.com/glossary/privilege-escalation/) and [lateral movement](https://startwithidentity.com/glossary/lateral-movement/).

## Sources

- [NVD: CVE-2024-20674](https://nvd.nist.gov/vuln/detail/CVE-2024-20674)
- Microsoft January 2024 Patch Tuesday