Start with Identity
Subscribe
Identity CVE · Kerberos / Active Directory

CVE-2026-20849Windows Kerberos elevation of privilege

high
Product: Windows Kerberos / Active DirectoryVendor: MicrosoftDisclosed: 2026-02-10Status: PatchedNVD ↗

What broke

Microsoft patched a Windows Kerberos elevation of privilege as CVE-2026-20849. High severity. Public write-ups are thinner than KerberLoss or ResetNightmare. Treat it as part of the same 2026 KDC patch train.

Why it matters

Kerberos EoP on a DC is never a workstation-only ticket. If you are already bundling CVE-2026-25177 and CVE-2026-27912, add this ID so change-management does not split the train.

What to do

  • Deploy the named Microsoft update on every DC.
  • Confirm with Get-HotFix / your patch report, not with "we did February."
  • After patching, watch for unusual TGT / TGS patterns. KDC bugs sometimes leave noisy exploit attempts in the security log.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.