Start with Identity
Subscribe
Identity CVE · Kerberos / Active Directory

CVE-2024-20674Windows Kerberos security feature bypass, impersonate the KDC

high · CVSS 8.8
Product: Windows KerberosVendor: MicrosoftDisclosed: 2024-01-09Status: PatchedNVD ↗

What broke

Windows Kerberos let an unauthenticated attacker on the network impersonate the Kerberos server (security feature bypass). Machine-in-the-middle, no prior account. CVSS 8.8. Microsoft patched it on 9 January 2024.

Why it matters

If you can impersonate the KDC, you can issue tickets. That is domain identity, not a workstation bug. Read it as the start of the 2024-2026 Kerberos train: PAC validation, PKINIT, CheckSum, KerberLoss.

What to do

  • Deploy January 2024 updates on DCs and on members that speak Kerberos.
  • Prefer SMB signing and channel binding so a forged KDC conversation is harder to land.
  • Watch for unexpected KDC referrals and TGT requests that do not match your DC inventory.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.