Start with Identity
Subscribe
Identity CVE · Kerberos / Active Directory

CVE-2024-26248Windows Kerberos PAC validation spoof, KB5020805 bypass

high
Product: Windows KerberosVendor: MicrosoftDisclosed: 2024-04-09Status: PatchedNVD ↗

What broke

The Kerberos Privilege Attribute Certificate (PAC) carries the user's groups and privileges. After CVE-2022-37967, Microsoft added PAC signature checks (KB5020805). CVE-2024-26248 lets a local attacker spoof that signature and skip the check, elevating on the workstation. CVE-2024-29056 is the cross-forest sibling. Patched 9 April 2024. Enforcement is staged: both DCs and clients need the update or authentication can fail.

Why it matters

PAC is how a service knows who you are after the TGT. Bypassing PAC validation is forging group membership. Identity teams who treated KB5020805 as "done in 2023" had to reopen the change in April 2024, then again for the 2025 PKINIT and S4U bugs.

What to do

  • Deploy April 2024 updates on DCs first, then members, then flip the PAC-validation enforcement mode Microsoft documented for 26248 / 29056.
  • Do not skip the client-side update. A patched DC and an unpatched workstation is how you get "Kerberos is broken" tickets.
  • Inventory service accounts that accept unconstrained delegation. PAC spoofing loves those.

Sources

  • NVD: CVE-2024-26248
  • Microsoft, "How to manage PAC Validation changes related to CVE-2024-26248 and CVE-2024-29056"

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.