{"id":"CVE-2014-6324","kind":"vulnerability","aliases":["CVE-2014-6324"],"related":[],"title":"Microsoft Kerberos Key Distribution Center (KDC): Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability","description":"The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain users to obtain domain administrator privileges via a forged signature in a ticket, as exploited in the wild in November 2014, aka \"Kerberos Checksum Vulnerability.\"","summary":"Microsoft's Kerberos Key Distribution Center (the domain authentication service on Windows domain controllers) has a flaw that lets any authenticated domain user escalate to domain administrator. This is a known exploited vulnerability listed by CISA.","severity":"critical","cvss":9.0,"epss":0.87335,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"Microsoft Kerberos Key Distribution Center (KDC)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["active-directory","domain-controllers","exploited","infrastructure","windows"],"not_affected_if":["no-active-directory-domain","patched-domain-controllers"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2014-6324 on all domain controllers, per vendor instructions (CISA required action).","status":"open","published_at":"2014-11-18T23:59:02+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:21:58+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:21:58Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2014-6324 on all domain controllers, per vendor instructions (CISA required action).","reach":"network","impact":"high","summary":"Microsoft's Kerberos Key Distribution Center (the domain authentication service on Windows domain controllers) has a flaw that lets any authenticated domain user escalate to domain administrator. This is a known exploited vulnerability listed by CISA.","category":"infrastructure","who_cares":["windows","active-directory","domain-controllers"],"confidence":0.7,"needs_auth":"yes","worst_case":"Any domain user gains domain administrator rights over the whole directory.","analyst_note":"Find the specific Microsoft bulletin (MS14-068) and affected Windows Server builds to write a concrete version check and fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-active-directory-domain","patched-domain-controllers"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00047,"input_tokens":2871,"output_tokens":365,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2014':17A,20A '-6324':18A,21A '2003':83C '2008':90C '2012':105C '2014':133C '7':96C '8':99C '8.1':101C 'activ':29B 'active-directori':28B 'administr':63B,117C 'aka':134C 'allow':109C 'authent':45B,57B,111C 'center':5A,11A,26A,42B,77C 'checksum':136C 'cisa':72B 'control':33B,50B 'cve':16A,19A 'directori':30B 'distribut':4A,10A,41B,76C 'distribution':25A 'domain':32B,44B,49B,58B,62B,112C,116C 'domain-control':31B 'escal':14A,60B 'exploit':34B,68B,127C 'flaw':53B 'forg':121C 'gold':106C 'infrastructur':35B 'kdc':6A,12A,27A,78C 'kerbero':2A,8A,39B,74C,135C 'kerberos':23A 'key':3A,9A,24A,40B,75C 'known':67B 'let':55B 'list':70B 'microsoft':1A,7A,22A,37B,80C 'novemb':132C 'obtain':115C 'privileg':13A,118C 'r2':93C,108C 'remot':110C 'server':82C,89C,104C 'servic':46B 'signatur':122C 'sp1':94C,97C 'sp2':84C,87C,91C 'ticket':125C 'user':59B,113C 'via':119C 'vista':86C 'vulner':15A,69B,137C 'wild':130C 'window':36B,48B,81C,85C,88C,95C,98C,100C,103C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2014-11-18T23:59:02+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2014-6324","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-6324","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T14:39:40+00:00","note":null},{"source":"epss","external_id":"CVE-2014-6324","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-6324","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2014-6324","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6324","severity":null,"published_at":"2014-11-18T23:59:02+00:00","modified_at":"2026-06-17T00:12:54+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}