# Windows Kerberos KDC hands out RC4 service tickets for Kerberoasting

Source: https://startwithidentity.com/cves/cve-2026-20833/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## What broke

When a service account had no `msDS-SupportedEncryptionTypes` value set, Windows domain controllers fell back to the domain default, and that default still allowed RC4. Microsoft's [KB5073381](https://support.microsoft.com/en-us/topic/1ebcda33-720a-4da8-93c1-b0496e1910dc) says this "might allow an attacker to obtain service tickets with weak or legacy encryption types such as RC4 to perform offline attacks to recover a service account password." MSRC published it on January 13, 2026 as an Important information disclosure flaw (CWE-327, broken or risky cryptographic algorithm), CVSS 3.1 5.5. Any authenticated domain user can request the ticket. Microsoft rated exploitation less likely, and the CVE is not on CISA KEV.

The fix rolled out in three phases. January 2026 updates added audit events. From April 14, 2026, updated KDCs default `DefaultDomainSupportedEncTypes` to AES-SHA1 only (`0x18`), with a `RC4DefaultDisablementPhase` registry rollback. From July 2026 the rollback key is gone and enforcement is permanent.

## Why it matters

This is [Kerberoasting](https://startwithidentity.com/techniques/kerberoasting/), built into the domain default. Any user who can log on could ask the KDC for a ticket encrypted with a service account's RC4 key, take it offline and guess the password, with nothing logged on the target service. A cracked service account is often a privileged one. The fix closes only the default path. Accounts that explicitly allow RC4, or a domain-wide `DefaultDomainSupportedEncTypes` that includes RC4, still issue roastable RC4 tickets, and AES tickets can still be attacked offline if the password is weak.

## What to do

- Make sure every domain controller has an update from April 2026 or later. July 2026 and later updates enforce AES-SHA1 by default.
- Check the System log on DCs for KDCSVC events 201 to 209. Event 205 means `DefaultDomainSupportedEncTypes` is explicitly set to an insecure value. Remove it or drop RC4 from it.
- Find accounts whose `msDS-SupportedEncryptionTypes` still allows RC4, fix the service or device, then remove the RC4 bit. Microsoft warns that the absence of audit events does not prove non-Windows devices will accept AES tickets, so test them.
- Give service accounts long random passwords or move them to group managed service accounts.

## Sources

- [NVD: CVE-2026-20833](https://nvd.nist.gov/vuln/detail/cve-2026-20833)
- [MSRC: Windows Kerberos Information Disclosure Vulnerability, CVE-2026-20833](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20833)
- [Microsoft KB5073381: How to manage Kerberos KDC usage of RC4 for service account ticket issuance changes related to CVE-2026-20833](https://support.microsoft.com/en-us/topic/1ebcda33-720a-4da8-93c1-b0496e1910dc)