Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker could bypass the Kerberos service ticketing feature which performs user access control checks.
According to the CVSS metric, the attack complexity is high (AC:H). What does this mean for this vulnerability?
An attacker would need specific conditions to be in place (i.e. particular protocol settings, or configurations, etc.) before an attack could succeed, which reduces the likelihood of widespread or opportunistic exploitation.
According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.
Security updates
10.0.26300.9711 — https://support.microsoft.com/help/5127648
10.0.17763.9376 — https://support.microsoft.com/help/5126651
10.0.20348.5761 — https://support.microsoft.com/help/5126655
10.0.26100.33650 — https://support.microsoft.com/help/5126646
10.0.28000.3231 — https://support.microsoft.com/help/5127646
10.0.14393.9612 — https://support.microsoft.com/help/5126868
6.2.9200.26434 — https://support.microsoft.com/help/5126835
6.3.9600.23470 — https://support.microsoft.com/help/5126836
Vulnerabilities 1
-
Medium 5.3
Windows Key Distribution Center Security Feature Bypass Vulnerability
Incorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a security feature over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-69640 Windows Key Distribution Center Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69640
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss