CVE-2026-20849CWE-807

CVE-2026-20849

High · published January 13, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
62.8
In the wild
Unconfirmed
What it is

⚡ An authorized attacker can elevate privileges over the network simply by exploiting untrusted inputs in Windows Kerberos! 🔥 Think of it like a restaurant where the chef blindly trusts any customer’s order without checking their identification, allowing someone to request the chef’s special without any credentials. This could lead to a diner suddenly having access to the kitchen! If exploited, this vulnerability could allow an attacker to gain elevated privileges, potentially leading to unauthorized access to sensitive resources and the ability to execute malicious actions across the network. The consequences could be absolutely devastating, as it puts the entire system at the mercy of the attacker!

Put simply

Think of it like a restaurant where the chef blindly trusts any customer’s order without checking their identification, allowing someone to request the chef’s special without any credentials. This could lead to a diner suddenly having access to the kitchen! This vulnerability arises from Windows Kerberos's reliance on untrusted inputs during security decisions, which allows attackers to manipulate the authentication process and gain higher access privileges than intended.

What to do

If exploited, this vulnerability could allow an attacker to gain elevated privileges, potentially leading to unauthorized access to sensitive resources and the ability to execute malicious actions across the network. The consequences could be absolutely devastating, as it puts the entire system at the mercy of the attacker! To mitigate this risk, ensure that your systems are updated to the latest Windows patches that address this CVE. Regularly audit your network permissions and security configurations, and consider implementing additional verification measures for all security decisions. 🛡️ You’ve got this! Follow these steps, and you’ll strengthen your defenses in no time! 💪✨

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01011 · 62.8th percentile
Weakness
CWE-807 · Reliance on Untrusted Inputs in a Security Decision
Published
2026-01-13T23:16Z
Affected products (19)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.878310.0.14393.8783
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:56Z
    Windows Kerberos Elevation of Privilege Vulnerability
    cvelistv5