{"id":"CVE-2026-85844","kind":"vulnerability","aliases":["CVE-2026-85844"],"related":[],"title":"Windows Kerberos: unauthenticated network attacker can reach SYSTEM on a domain controller (October 2026 Patch Tuesday)","description":"Authentication bypass using an alternate path or channel in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.","summary":"Microsoft rates this Windows Kerberos elevation of privilege 9.8, Important, Exploitation More Likely, fixed in the October 2026 Patch Tuesday. Per a secondary write-up of Microsoft's guidance, an unauthenticated attacker sends crafted Kerberos authentication traffic, relays the result to a domain controller and gets SYSTEM with no user interaction. Not confirmed as exploited. Affected builds and KB numbers were not read from Microsoft's page.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["active-directory","domain-controller","infrastructure","kerberos","on-premises","windows"],"not_affected_if":["no-domain-controllers"],"how_to_check":"Unknown from a primary source. Check whether your domain controllers have the October 2026 cumulative update installed; the exact KB and build numbers are on the MSRC Security Update Guide entry for CVE-2026-85844 (JavaScript-only page, could not be read here).","fix":"Install the October 2026 Windows security update on domain controllers first. Exact KB and builds not confirmed.","status":"open","published_at":"2026-11-10T19:21:25+00:00","first_seen_at":"2026-11-10T19:25:18+00:00","triaged_at":"2026-11-10T19:25:36+00:00","updated_at":"2026-11-10T19:30:29+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:25:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Kerberos: authentication bypass lets an attacker gain elevated privileges over the network","impact":"high","summary":"Windows Kerberos has an authentication bypass through an alternate path or channel. An unauthorized attacker on the network can elevate privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","kerberos","active-directory"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker gains elevated privileges over the network","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-85844 to get affected Windows builds, fixed versions and mitigations.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows systems that use Kerberos for authentication, such as domain controllers and domain-joined servers and workstations. The sources do not say which Windows builds are affected or what configuration is required.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000654,"input_tokens":4501,"output_tokens":408,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-85844 to get affected Windows builds, fixed versions and mitigations.","search":"'-2026':18A,21A '-85844':19A,22A '2026':14A,52B '9.8':43B 'activ':24B 'active-directori':23B 'affect':91B 'allow':114C 'altern':107C 'attack':5A,67B,117C 'authent':71B,103C 'build':92B 'bypass':104C 'channel':110C 'confirm':88B 'control':12A,28B,79B 'craft':69B 'cve':17A,20A 'directori':25B 'domain':11A,27B,78B 'domain-control':26B 'elev':40B,119C 'exploit':45B,90B 'fix':48B 'get':81B 'guidanc':64B 'import':44B 'infrastructur':29B 'interact':86B 'kb':94B 'kerbero':2A,30B,39B,70B,113C 'like':47B 'microsoft':35B,62B,100B 'network':4A,123C 'number':95B 'octob':13A,51B 'on-premis':31B 'page':102B 'patch':15A,53B 'path':108C 'per':55B 'premis':33B 'privileg':42B,120C 'rate':36B 'reach':7A 'read':98B 'relay':73B 'result':75B 'secondari':57B 'send':68B 'system':8A,82B 'traffic':72B 'tuesday':16A,54B 'unauthent':3A,66B 'unauthor':116C 'use':105C 'user':85B 'window':1A,34B,38B,112C 'write':59B 'write-up':58B","nicknames":[],"mitigations":[],"who_affected":"Windows systems that use Kerberos for authentication, such as domain controllers and domain-joined servers and workstations. The sources do not say which Windows builds are affected or what configuration is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["activedirectory","critical","domaincontroller","infrastructure","kerberos","onpremises","windows"],"campaign_type":null,"search_a":"'-2026':18A,21A '-85844':19A,22A '2026':14A 'attack':5A 'control':12A 'cve':17A,20A 'domain':11A 'kerbero':2A 'network':4A 'octob':13A 'patch':15A 'reach':7A 'system':8A 'tuesday':16A 'unauthent':3A 'window':1A","search_b":"'2026':52B '9.8':43B 'activ':24B 'active-directori':23B 'affect':91B 'attack':67B 'authent':71B 'build':92B 'confirm':88B 'control':28B,79B 'craft':69B 'directori':25B 'domain':27B,78B 'domain-control':26B 'elev':40B 'exploit':45B,90B 'fix':48B 'get':81B 'guidanc':64B 'import':44B 'infrastructur':29B 'interact':86B 'kb':94B 'kerbero':30B,39B,70B 'like':47B 'microsoft':35B,62B,100B 'number':95B 'octob':51B 'on-premis':31B 'page':102B 'patch':53B 'per':55B 'premis':33B 'privileg':42B 'rate':36B 'read':98B 'relay':73B 'result':75B 'secondari':57B 'send':68B 'system':82B 'traffic':72B 'tuesday':54B 'unauthent':66B 'user':85B 'window':34B,38B 'write':59B 'write-up':58B","search_c":"'allow':114C 'altern':107C 'attack':117C 'authent':103C 'bypass':104C 'channel':110C 'elev':119C 'kerbero':113C 'network':123C 'path':108C 'privileg':120C 'unauthor':116C 'use':105C 'window':112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85844","severity":null,"published_at":"2026-11-10T19:21:25+00:00","modified_at":"2026-11-10T19:21:25+00:00","first_seen_at":"2026-11-10T19:25:18+00:00","fetched_at":"2026-11-10T19:25:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-85844:2513","url":"https://www.absolute.com/blog/october-2026-patch-tuesday-1404-fixes-and-an-exploited-motw-bypass","severity":null,"published_at":"2026-11-10T19:30:29+00:00","modified_at":"2026-11-10T19:30:29+00:00","first_seen_at":"2026-11-10T19:30:29+00:00","fetched_at":"2026-11-10T19:30:29+00:00","note":"MSRC page and NVD page are JS-only/empty here; only secondary source (Absolute blog, Oct 13 2026) read. Nothing verified. Revisit to read MSRC for builds, KBs, mitigations.","cites":["https://www.absolute.com/blog/october-2026-patch-tuesday-1404-fixes-and-an-exploited-motw-bypass"]}],"documents":[{"id":117571,"url":"https://www.absolute.com/blog/october-2026-patch-tuesday-1404-fixes-and-an-exploited-motw-bypass","title":"October 2026 Patch Tuesday (Absolute)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}