{"id":"CVE-2026-70240","kind":"vulnerability","aliases":["CVE-2026-70240"],"related":[],"title":"Windows Kerberos: memory leak lets a network attacker deny service","description":"Missing release of memory after effective lifetime in Windows Kerberos allows an unauthorized attacker to deny service over a network.","summary":"Windows Kerberos does not release memory after it is no longer needed, a flaw that a remote, unauthenticated attacker can trigger over the network. The result is a denial of service, meaning the affected system can slow down or stop responding.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["active-directory","infrastructure","kerberos","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:21+00:00","first_seen_at":"2026-11-10T19:25:17+00:00","triaged_at":"2026-11-10T19:43:03+00:00","updated_at":"2026-11-10T19:43:03+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:43:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Kerberos: memory leak lets a network attacker deny service","impact":"low","summary":"Windows Kerberos does not release memory after it is no longer needed, a flaw that a remote, unauthenticated attacker can trigger over the network. The result is a denial of service, meaning the affected system can slow down or stop responding.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","active-directory","kerberos"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Kerberos service becomes unresponsive, disrupting Windows authentication","analyst_note":"Find the affected Windows builds and Microsoft's fixed KB from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-70240 and the Microsoft Security Response Center advisory.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows systems that act as Kerberos servers or domain controllers are the ones that handle this protocol traffic over the network. Sources do not say which Windows versions are affected or whether client-only machines are exposed. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000695,"input_tokens":4495,"output_tokens":490,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and Microsoft's fixed KB from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-70240 and the Microsoft Security Response Center advisory.","search":"'-2026':12A,15A '-70240':13A,16A 'activ':18B 'active-directori':17B 'affect':56B 'allow':74C 'attack':8A,41B,77C 'cve':11A,14A 'deni':9A,79C 'denial':51B 'directori':19B 'effect':69C 'flaw':36B 'infrastructur':20B 'kerbero':2A,21B,24B,73C 'leak':4A 'let':5A 'lifetim':70C 'longer':33B 'mean':54B 'memori':3A,28B,67C 'miss':64C 'need':34B 'network':7A,46B,83C 'releas':27B,65C 'remot':39B 'respond':63B 'result':48B 'servic':10A,53B,80C 'slow':59B 'stop':62B 'system':57B 'trigger':43B 'unauthent':40B 'unauthor':76C 'window':1A,22B,23B,72C","nicknames":[],"mitigations":[],"who_affected":"Windows systems that act as Kerberos servers or domain controllers are the ones that handle this protocol traffic over the network. Sources do not say which Windows versions are affected or whether client-only machines are exposed. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["activedirectory","high","infrastructure","kerberos","windows"],"campaign_type":null,"search_a":"'-2026':12A,15A '-70240':13A,16A 'attack':8A 'cve':11A,14A 'deni':9A 'kerbero':2A 'leak':4A 'let':5A 'memori':3A 'network':7A 'servic':10A 'window':1A","search_b":"'activ':18B 'active-directori':17B 'affect':56B 'attack':41B 'denial':51B 'directori':19B 'flaw':36B 'infrastructur':20B 'kerbero':21B,24B 'longer':33B 'mean':54B 'memori':28B 'need':34B 'network':46B 'releas':27B 'remot':39B 'respond':63B 'result':48B 'servic':53B 'slow':59B 'stop':62B 'system':57B 'trigger':43B 'unauthent':40B 'window':22B,23B","search_c":"'allow':74C 'attack':77C 'deni':79C 'effect':69C 'kerbero':73C 'lifetim':70C 'memori':67C 'miss':64C 'network':83C 'releas':65C 'servic':80C 'unauthor':76C 'window':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-70240","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70240","severity":null,"published_at":"2026-11-10T19:21:21+00:00","modified_at":"2026-11-10T19:21:21+00:00","first_seen_at":"2026-11-10T19:25:17+00:00","fetched_at":"2026-11-10T19:25:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}