{"id":"CVE-2026-122164","kind":"vulnerability","aliases":["CVE-2026-122164"],"related":[],"title":"Windows Kerberos: weak authentication lets an authorized user gain higher privileges","description":"Weak authentication in Windows Kerberos allows an authorized attacker to elevate privileges over a network.","summary":"Windows Kerberos, the domain login protocol, has a weak authentication flaw. An attacker who already holds a valid account can elevate their privileges over the network.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":">= 10.0.14393.0, < 10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":">= 10.0.19044.0, < 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":">= 10.0.20348.0, < 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">= 10.0.22631.0, < 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":">= 10.0.26100.0, < 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":">= 10.0.26200.0, < 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":">= 10.0.26300.0, < 10.0.26300.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":">= 10.0.28000.0, < 10.0.28000.3501","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"microsoft"}],"ecosystems":[],"tags":["active-directory","auth-required","infrastructure","kerberos","windows"],"not_affected_if":["no-domain-accounts","patched-nov-2026"],"how_to_check":"Run winver or [System.Environment]::OSVersion / (Get-ComputerInfo).OsVersion on each host, including domain controllers, and compare the full build (e.g. 10.0.20348.x) with the fixed build for that Windows version. Below the fixed build means exposed. Microsoft's update guide entry for the CVE lists the KB per SKU.","fix":"Install the November 2026 cumulative update so the build is at or above: Windows 10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Server 2022 10.0.20348.5870; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H2 10.0.26300.9974; 26H1 10.0.28000.3501; Server 2025 10.0.26100.33822.","status":"open","published_at":"2026-11-10T19:20:33+00:00","first_seen_at":"2026-11-10T19:25:09+00:00","triaged_at":"2026-11-10T19:36:07+00:00","updated_at":"2026-11-10T21:43:13+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-10T19:36:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Kerberos: weak authentication lets an authorized user gain higher privileges","impact":"high","summary":"Windows Kerberos, the domain login protocol, has a weak authentication flaw. An attacker who already holds a valid account can elevate their privileges over the network.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","kerberos","active-directory"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authorized attacker gains higher privileges over the network","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-122164 to get affected builds and the fixed update.","how_to_check":"- Confirm the Windows build is in the affected range from Microsoft's security update guide for CVE-2026-122164 (unknown from the sources)\n- Check whether Windows Update shows the latest cumulative update installed (unknown from the sources)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-domain-accounts"],"who_is_affected":"Windows systems that take part in Kerberos authentication, such as domain controllers and domain-joined servers and workstations, are the places to look. The sources do not give the affected builds or any configuration needed. An attacker needs a valid account first, so systems with no domain accounts exposed to untrusted users are lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4484,"output_tokens":524,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-122164 to get affected builds and the fixed update.","search":"'-122164':14A,17A '-2026':13A,16A '10':19A,24A,29A,32A '11':38A,41A,44A,47A,50A '1607':20A '1809':25A '2016':22A '2019':27A '2022':36A '2025':54A '21h2':30A '22h2':33A '23h2':39A '24h2':42A '25h2':45A '26h1':51A '26h2':48A 'account':82B 'activ':56B 'active-directori':55B 'allow':95C 'alreadi':78B 'attack':76B,98C 'auth':59B 'auth-requir':58B 'authent':4A,73B,91C 'author':7A,97C 'cve':12A,15A 'directori':57B 'domain':67B 'elev':84B,100C 'flaw':74B 'gain':9A 'higher':10A 'hold':79B 'infrastructur':61B 'kerbero':2A,62B,65B,94C 'let':5A 'login':68B 'network':89B,104C 'privileg':11A,86B,101C 'protocol':69B 'requir':60B 'server':21A,26A,35A,53A 'user':8A 'valid':81B 'weak':3A,72B,90C 'window':1A,63B,64B,93C 'windows':18A,23A,28A,31A,34A,37A,40A,43A,46A,49A,52A","nicknames":[],"mitigations":[],"who_affected":"Every supported Windows client and server release listed by Microsoft (Windows 10 1607 through Windows 11 26H2, Server 2016 through 2025) below the November 2026 fixed build. Microsoft rates it network-reachable, high complexity, and it needs an authorized attacker with high privileges, with scope changed. Prioritise domain controllers and domain-joined servers; machines not using Kerberos or domain accounts are lower risk.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:43:13Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-122164","run_id":2841},"products":{"at":"2026-11-10T21:43:13Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-122164","run_id":2841}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["activedirectory","authrequired","high","infrastructure","kerberos","windows"],"campaign_type":null,"search_a":"'-122164':14A,17A '-2026':13A,16A '10':19A,24A,29A,32A '11':38A,41A,44A,47A,50A '1607':20A '1809':25A '2016':22A '2019':27A '2022':36A '2025':54A '21h2':30A '22h2':33A '23h2':39A '24h2':42A '25h2':45A '26h1':51A '26h2':48A 'authent':4A 'author':7A 'cve':12A,15A 'gain':9A 'higher':10A 'kerbero':2A 'let':5A 'privileg':11A 'server':21A,26A,35A,53A 'user':8A 'weak':3A 'window':1A 'windows':18A,23A,28A,31A,34A,37A,40A,43A,46A,49A,52A","search_b":"'account':82B 'activ':56B 'active-directori':55B 'alreadi':78B 'attack':76B 'auth':59B 'auth-requir':58B 'authent':73B 'directori':57B 'domain':67B 'elev':84B 'flaw':74B 'hold':79B 'infrastructur':61B 'kerbero':62B,65B 'login':68B 'network':89B 'privileg':86B 'protocol':69B 'requir':60B 'valid':81B 'weak':72B 'window':63B,64B","search_c":"'allow':95C 'attack':98C 'authent':91C 'author':97C 'elev':100C 'kerbero':94C 'network':104C 'privileg':101C 'weak':90C 'window':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122164","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122164","severity":null,"published_at":"2026-11-10T19:20:33+00:00","modified_at":"2026-11-10T19:20:33+00:00","first_seen_at":"2026-11-10T19:25:09+00:00","fetched_at":"2026-11-10T19:25:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122164:2841","url":"https://cveawg.mitre.org/api/cve/CVE-2026-122164","severity":null,"published_at":"2026-11-10T21:43:13+00:00","modified_at":"2026-11-10T21:43:13+00:00","first_seen_at":"2026-11-10T21:43:13+00:00","fetched_at":"2026-11-10T21:43:13+00:00","note":"Read Microsoft's CNA CVE record (cveawg); affected/fixed builds per product from it. MSRC update-guide page is JS-only and was not read, so KB numbers per SKU are unknown; Win10 22H2/21H2 builds match KB5131096 (BleepingComputer). Not exploited, no PoC found. CVSS vector says PR:H, so attacker needs high privileges, scope changed.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-122164"]}],"documents":[{"id":118982,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-122164","title":"CVE-2026-122164 CVE record published by Microsoft (CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":117830,"url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5131096-extended-security-update/","title":"Windows 10 KB5131096 ESU (Nov 2026 Patch Tuesday)","kind":"blog","source":"blog","publisher":null,"text":"Microsoft releases Windows 10 KB5131096 extended security update\n\nMicrosoft released the Windows 10 KB5131096 extended security update, which includes this month's November 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]","published_at":"2026-11-10T20:04:36+00:00","relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}