CVE-2025-26647 - Vulnerability Details

- Windows Kerberos Elevation of Privilege Vulnerability

Description

Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network.

Published: 2025-04-08

Score: 8.8 High

EPSS: 2.6% Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Windows Server 2008 R2 Service Pack 1

affected

Version	Status	Constraints
`6.1.7601.0`	affected	< 6.1.7601.27670

Microsoft

Windows Server 2008 R2 Service Pack 1 (Server Core installation)

affected

Version	Status	Constraints
`6.1.7601.0`	affected	< 6.1.7601.27670

Microsoft

Windows Server 2008 Service Pack 2

affected

Version	Status	Constraints
`6.0.6003.0`	affected	< 6.0.6003.23220

Microsoft

Windows Server 2008 Service Pack 2 (Server Core installation)

affected

Version	Status	Constraints
`6.0.6003.0`	affected	< 6.0.6003.23220

Microsoft

Windows Server 2012

affected

Version	Status	Constraints
`6.2.9200.0`	affected	< 6.2.9200.25423

Microsoft

Windows Server 2012 (Server Core installation)

affected

Version	Status	Constraints
`6.2.9200.0`	affected	< 6.2.9200.25423

Microsoft

Windows Server 2012 R2

affected

Version	Status	Constraints
`6.3.9600.0`	affected	< 6.3.9600.22523

Microsoft

Windows Server 2012 R2 (Server Core installation)

affected

Version	Status	Constraints
`6.3.9600.0`	affected	< 6.3.9600.22523

Microsoft

Windows Server 2016

affected

Version	Status	Constraints
`10.0.14393.0`	affected	< 10.0.14393.7969

Microsoft

Windows Server 2016 (Server Core installation)

affected

Version	Status	Constraints
`10.0.14393.0`	affected	< 10.0.14393.7969

Microsoft

Windows Server 2019

affected

Version	Status	Constraints
`10.0.17763.0`	affected	< 10.0.17763.7136

Microsoft

Windows Server 2019 (Server Core installation)

affected

Version	Status	Constraints
`10.0.17763.0`	affected	< 10.0.17763.7136

Microsoft

Windows Server 2022

affected

Version	Status	Constraints
`10.0.20348.0`	affected	< 10.0.20348.3453

Microsoft

Windows Server 2022, 23H2 Edition (Server Core installation)

affected

Version	Status	Constraints
`10.0.25398.0`	affected	< 10.0.25398.1551

Microsoft

Windows Server 2025

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.3775

Microsoft

Windows Server 2025 (Server Core installation)

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.3775

Configuration 1 [-]

OR	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x86:*
	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*
	cpe:2.3:o:microsoft:windows_server_2016::::::::
	cpe:2.3:o:microsoft:windows_server_2019::::::::
	cpe:2.3:o:microsoft:windows_server_2022::::::::
	cpe:2.3:o:microsoft:windows_server_2022_23h2::::::::
	cpe:2.3:o:microsoft:windows_server_2025::::::::

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2025-10222	Improper input validation in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0259.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26647

History

Fri, 13 Feb 2026 20:00:00 +0000

Type	Values Removed	Values Added
Description	Improper input validation in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.	Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
First Time appeared		Microsoft windows Server 2008 R2 Microsoft windows Server 2008 Sp2 Microsoft windows Server 2012 R2 Microsoft windows Server 23h2
CPEs		cpe:2.3:o:microsoft:windows_server_2008_R2:::::::x64:* cpe:2.3:o:microsoft:windows_server_2008_sp2:::::::x64:* cpe:2.3:o:microsoft:windows_server_2012:::::::x64:* cpe:2.3:o:microsoft:windows_server_2012_R2:::::::x64:* cpe:2.3:o:microsoft:windows_server_23h2::::::::
Vendors & Products		Microsoft windows Server 2008 R2 Microsoft windows Server 2008 Sp2 Microsoft windows Server 2012 R2 Microsoft windows Server 23h2

Fri, 11 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00129}`	epss `{'score': 0.00139}`

Thu, 10 Jul 2025 16:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Microsoft Microsoft windows Server 2008 Microsoft windows Server 2012 Microsoft windows Server 2016 Microsoft windows Server 2019 Microsoft windows Server 2022 Microsoft windows Server 2022 23h2 Microsoft windows Server 2025
CPEs		cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x64:* cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x86:* cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:* cpe:2.3:o:microsoft:windows_server_2012:-:::::::* cpe:2.3:o:microsoft:windows_server_2012:r2:::::::* cpe:2.3:o:microsoft:windows_server_2016:::::::: cpe:2.3:o:microsoft:windows_server_2019:::::::: cpe:2.3:o:microsoft:windows_server_2022:::::::: cpe:2.3:o:microsoft:windows_server_2022_23h2:::::::: cpe:2.3:o:microsoft:windows_server_2025::::::::
Vendors & Products		Microsoft Microsoft windows Server 2008 Microsoft windows Server 2012 Microsoft windows Server 2016 Microsoft windows Server 2019 Microsoft windows Server 2022 Microsoft windows Server 2022 23h2 Microsoft windows Server 2025

Fri, 11 Apr 2025 20:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`

Tue, 08 Apr 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 08 Apr 2025 17:30:00 +0000

Type	Values Removed	Values Added
Description		Improper input validation in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.
Title		Windows Kerberos Elevation of Privilege Vulnerability
Weaknesses		CWE-20
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26647
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`

Subscriptions

Microsoft Windows Server 2008 Windows Server 2008 R2 Windows Server 2008 Sp2 Windows Server 2012 Windows Server 2012 R2 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2022 23h2 Windows Server 2025 Windows Server 23h2

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2025-04-08T17:23:49.183Z

Updated: 2026-02-13T19:33:06.786Z

Reserved: 2025-02-12T19:23:29.269Z

Link: CVE-2025-26647

Vulnrichment

Updated: 2025-04-08T20:03:55.972Z

NVD

Status : Modified

Published: 2025-04-08T18:15:48.510

Modified: 2026-02-13T20:16:53.983

Link: CVE-2025-26647

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-20

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object