Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.8

Windows Kerberos allows unauthorized access over the network

CVE-2026-24297 · published 7 months ago
Summary

A security feature in Windows Kerberos is vulnerable to unauthorized access over the network. This means that an attacker could potentially bypass security checks and gain access to sensitive information. To protect your network, apply the latest Windows updates as soon as possible.

What to do
  • Update microsoft windows_10_1607 to version 10.0.14393.8957 or later.
  • Update microsoft windows_10_1809 to version 10.0.17763.8511 or later.
  • Update microsoft windows_10_21h2 to version 10.0.19044.7058 or later.
  • Update microsoft windows_10_22h2 to version 10.0.19045.7058 or later.
  • Update microsoft windows_server_2016 to version 10.0.14393.8957 or later.
  • Update microsoft windows_server_2019 to version 10.0.17763.8511 or later.
Affected software
VendorProductAffected versions
microsoft windows_10_1607 < 10.0.14393.8957
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
microsoft windows_10_1809 < 10.0.17763.8511
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
microsoft windows_10_21h2 < 10.0.19044.7058
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*
microsoft windows_10_22h2 < 10.0.19045.7058
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*
microsoft windows_server_2012 r2
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
microsoft windows_server_2016 < 10.0.14393.8957
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
microsoft windows_server_2019 < 10.0.17763.8511
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
Original advisory text
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kerberos allows an unauthorized attacker to bypass a security feature over a network.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kerberos allows an unauthorized attacker to bypass a security feature over a network.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
4.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-362Race Condition
Timeline
Published10 Mar 2026
Updated4 Nov 2026
First seen11 Mar 2026
Sources
CVE-2026-24297 · NVD
Track software like this
Free during beta