Identity CVE · Kerberos / Active Directory
CVE-2025-21242Windows Kerberos information disclosure
medium
What broke
Windows Kerberos leaked information a low-privileged caller should not have seen. Medium severity. Microsoft patched it in the January 2025 updates.
Why it matters
Info-disclosure on the KDC is how you seed the next escalation: usernames, etypes, or ticket metadata that make password spraying and delegation abuse cheaper. It is not CheckSum, and you should not brief it that way. You should still take the patch, because Kerberos updates ship as a train.
What to do
- Keep DCs current. Do not skip "medium" Kerberos CVEs to save a change window.
- Monitor for unusual TGS requests after you patch. Disclosure bugs sometimes show up in tooling before they show up in tickets.
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.