CVE-2026-27912

Name of the Vulnerable Software and Affected Versions Windows (affected versions not specified)

Description Improper authorization in the Windows Kerberos implementation, specifically a validation flaw in the Kerberos Change Password protocol, allows an authorized attacker to elevate privileges over an adjacent network. This issue enables the resetting of the password for any target user or computer account without knowledge of the current password. Exploitation requires an unpatched domain controller and the ability to write a userPrincipalName (UPN) on an account controlled by the attacker, or the ability to create new users or computers in any Organizational Unit (OU), which grants GenericWrite permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.