CVE-2026-20833Windows Kerberos KDC hands out RC4 service tickets for Kerberoasting
What broke
When a service account had no msDS-SupportedEncryptionTypes value set, Windows domain controllers fell back to the domain default, and that default still allowed RC4. Microsoft's KB5073381 says this "might allow an attacker to obtain service tickets with weak or legacy encryption types such as RC4 to perform offline attacks to recover a service account password." MSRC published it on January 13, 2026 as an Important information disclosure flaw (CWE-327, broken or risky cryptographic algorithm), CVSS 3.1 5.5. Any authenticated domain user can request the ticket. Microsoft rated exploitation less likely, and the CVE is not on CISA KEV.
The fix rolled out in three phases. January 2026 updates added audit events. From April 14, 2026, updated KDCs default DefaultDomainSupportedEncTypes to AES-SHA1 only (0x18), with a RC4DefaultDisablementPhase registry rollback. From July 2026 the rollback key is gone and enforcement is permanent.
Why it matters
This is Kerberoasting, built into the domain default. Any user who can log on could ask the KDC for a ticket encrypted with a service account's RC4 key, take it offline and guess the password, with nothing logged on the target service. A cracked service account is often a privileged one. The fix closes only the default path. Accounts that explicitly allow RC4, or a domain-wide DefaultDomainSupportedEncTypes that includes RC4, still issue roastable RC4 tickets, and AES tickets can still be attacked offline if the password is weak.
What to do
- Make sure every domain controller has an update from April 2026 or later. July 2026 and later updates enforce AES-SHA1 by default.
- Check the System log on DCs for KDCSVC events 201 to 209. Event 205 means
DefaultDomainSupportedEncTypesis explicitly set to an insecure value. Remove it or drop RC4 from it. - Find accounts whose
msDS-SupportedEncryptionTypesstill allows RC4, fix the service or device, then remove the RC4 bit. Microsoft warns that the absence of audit events does not prove non-Windows devices will accept AES tickets, so test them. - Give service accounts long random passwords or move them to group managed service accounts.
Sources
Related identity CVEs
Related on Start with Identity
- CVEWindows Kerberos security feature bypass, impersonate the KDC
An unauthenticated machine-in-the-middle can impersonate a Windows Kerberos server. CVSS 8.8. January 2024 Patch Tuesday. The 2024 opening shot in a two-year Ke
- CVEWindows Kerberos elevation of privilege
A 2026 Windows Kerberos elevation of privilege, patched by Microsoft. High severity. Read it next to KerberLoss and ResetNightmare: the 2026 AD year is a Kerber
- CVEWindows Kerberos information disclosure
A medium-severity Kerberos information-disclosure in Windows. Not a domain-compromise bug on its own, but it sits in the same 2025 Kerberos patch train as the S
- BlogKerberLoss: invisible Unicode lets an attacker twin a Kerberos SPN
CVE-2026-25177, CVSS 8.8. Active Directory treated look-alike SPNs as unique. Semperis and Shai Laron showed how that becomes service hijack and NTLM downgrade.
- BlogResetNightmare: a low-priv UPN write can reset a Domain Admin via Kerberos kpasswd
CVE-2026-27912 lets a user who can write their own UPN aim a Kerberos change-password at a Domain Admin. Microsoft rated it Important. Identity teams should not
- BlogA FreeIPA flaw chain let an anonymous client write itself a reusable administrator credential
CVE-2026-76578 (CVSS 9.8) chains with a 389 Directory Server ownership-check bug so an unauthenticated client can create an OTP token entry, pass the ownership
Technique
This CVE is an instance of Kerberoasting. Any authenticated domain user can request a Kerberos service ticket for any service principal, and that ticket is encrypted with the service account's own password hash, offline and unrateable to test.