CVE-2026-69676 – Windows Kerberos Remote Code Execution Vulnerability

CVE-2026-69676 is a Critical Windows Kerberos remote code execution vulnerability caused by an authentication bypass through capture-replay (CWE-294). An authenticated attacker with low-level access to an affected server can send a specially crafted request over the network and execute code on that server. No user interaction is required. The vulnerability is not publicly disclosed and is not reported as exploited.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires only low privileges. Successful exploitation can have a high impact on confidentiality, integrity, and availability. Because no user interaction is required, an attacker who already has low-level authenticated access could attempt exploitation without requiring a victim to open a file, click a link, or perform another action.

EXPLOITS: Exploitation is assessed as More Likely. The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is listed as Unproven. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability affects Windows Kerberos and is categorized as CWE-294, Authentication Bypass by Capture-replay. An authenticated attacker with low-level access to an affected server can send a specially crafted request over the network to execute code on the server. The attack has low complexity, requires low privileges, and requires no user interaction. Successful exploitation can result in high confidentiality, integrity, and availability impact while leaving the security scope unchanged.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1 on the architectures listed for each release; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. An authenticated attacker with low privileges can exploit the issue remotely by sending a specially crafted request to an affected server.

BUSINESS IMPACT: Successful exploitation could allow an attacker to execute code remotely on an affected server, creating the potential for significant compromise of business systems and data. With high confidentiality, integrity, and availability impacts, exploitation could expose sensitive information, enable unauthorized modification, and disrupt affected services. The low attack complexity and absence of a user-interaction requirement increase the operational concern.

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8, network-based exploitation, low attack complexity, and no user interaction requirement. Although it is not reported as exploited or publicly disclosed and exploit code maturity is Unproven, exploitation is assessed as More Likely. Organizations should prioritize deployment of the official fix across affected Windows client and server systems.