Loading vulnerability…
Windows Kerberos Authentication Bypass and Privilege Escalation
CVE-2026-85844 is an authentication bypass through an alternate path or channel in Windows Kerberos. An unauthenticated network attacker can send specially crafted Kerberos authentication traffic and relay the resulting authentication to an affected domain controller to obtain SYSTEM privileges without user interaction. Microsoft rates the vulnerability Important, with a CVSS v3.1 base score of 9.8. The specific vulnerable function and affected version boundaries are not available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation grants SYSTEM privileges on an affected domain controller, potentially severely compromising confidentiality, integrity, and availability through privileged access to systems and data.
If you can’t patch tonight, do this now.
No vulnerability-specific interim mitigation or workaround is identified. Consult Microsoft's advisory for any updated workaround guidance; general NTLM hardening measures are not established mitigations for this Kerberos vulnerability.
Patch, then assume compromise.
Apply the Microsoft security update addressing CVE-2026-85844, released as part of the November 10, 2026 security updates. Consult the Microsoft Security Update Guide to select the applicable update for each Windows release and architecture, prioritizing affected domain controllers and authentication infrastructure. Specific KB identifiers and fixed build numbers are not available. Verify successful installation through endpoint management reporting and vulnerability scanning.
No public exploits tracked yet. Mallory keeps watching.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.