CVE-2026-20849Windows Kerberos elevation of privilege

What broke

Microsoft patched a Windows Kerberos elevation of privilege as CVE-2026-20849. High severity. Public write-ups are thinner than KerberLoss or ResetNightmare. Treat it as part of the same 2026 KDC patch train.

Why it matters

Kerberos EoP on a DC is never a workstation-only ticket. If you are already bundling CVE-2026-25177 and CVE-2026-27912, add this ID so change-management does not split the train.

What to do

• Deploy the named Microsoft update on every DC.
• Confirm with Get-HotFix / your patch report, not with "we did February."
• After patching, watch for unusual TGT / TGS patterns. KDC bugs sometimes leave noisy exploit attempts in the security log.

After you patch

Active Directory compromise is not contained by patching, because the artifacts an attacker creates outlive the vulnerability.

• Rotate the krbtgt account twice, with the replication interval between rotations, if there is any indication of ticket forgery. One rotation is not enough.
• Audit AD CS certificate templates for enrolment and enrollee-supplied-subject permissions, which are the most common escalation path left behind. See certificate lifecycle.
• Review privileged group membership and delegation rights (Domain Admins, DnsAdmins, constrained and resource-based constrained delegation) for changes during the window.
• Hunt for tickets with anomalous lifetimes or encryption types, and for authentications to services that identity never touches.
• Treat any issued certificate as a durable credential: revoking a user's password does not revoke a certificate that authenticates as them. See privilege escalation and lateral movement.

Sources

• NVD: CVE-2026-20849