CVE-2026-47288: Windows Kerberos Key Distribution Center (KDC) Remote Code Execution

Synopsis

An integer overflow in Windows Kerberos (the Key Distribution Center component) allows an attacker with a low-privilege account on the same network segment to execute arbitrary code on the target host. The flaw is reachable over an adjacent network (LAN, VPN, or similar), requires a valid low-privilege credential, and does not need any victim interaction. Successful exploitation gives the attacker full control over the affected system. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows Server releases.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network such as a LAN, VPN segment, or similar layer-2 or layer-3 boundary; remote exploitation over the open internet is not possible.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker must authenticate to the Kerberos service with any valid domain credential before the overflow is reachable.

• Victim interactionNot required

  No action by a logged-in user or administrator is needed; the attacker can trigger the overflow through their own requests to the KDC.

• Attack complexityDetail

  Attack complexity is high, meaning the exploit depends on specific environmental conditions such as race conditions or memory layout factors that the attacker cannot fully control and may require repeated attempts.

Blast Radius

• The attacker executes arbitrary code in the context of the KDC service process, gaining the ability to run any command on the Domain Controller hosting it.
• All Kerberos ticket issuance and authentication for the domain passes through the KDC, so a compromised KDC exposes stored Kerberos secrets, ticket-granting ticket keys, and cached credential material.
• The attacker can forge Kerberos tickets (golden ticket scenario), granting persistent authenticated access to any service in the domain without valid credentials.
• The KDC process and its host can be crashed or made unavailable, blocking domain authentication for all users and services that rely on that Domain Controller.