A vulnerable implementation of the Kerberos authentication protocol in Microsoft Windows uses a broken or insecure cryptographic algorithm, allowing an authorized local attacker to read privileged information. The flaw permits the attacker to retrieve secrets such as ticket data or cryptographic keys that are otherwise protected by Kerberos, violating confidentiality for the user and the system. The weakness is a classic example of CWE-327, which indicates insecure or weak cryptographic practices.

Microsoft Windows Server 2008 R2 Service Pack 1 (including Server Core), Windows Server 2008 Service Pack 2 (including Server Core), Windows Server 2012 (including Server Core), Windows Server 2012 R2 (including Server Core), Windows Server 2016 (including Server Core), Windows Server 2019 (including Server Core), Windows Server 2022 and the 23H2 Edition (including Server Core), and the upcoming Windows Server 2025 (including Server Core).

The consolidated CVSS score of 5.5 categorizes this flaw as a moderate severity vulnerability. EPSS indicates an exploitation probability of less than 1%, signifying a low likelihood of widespread exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalogue, suggesting no confirmed widespread exploitation. The likely attack vector is local; an attacker who has legitimate user or service privileges on the target machine can exploit the weakened Kerberos cryptographic routine to disclose protected information. No remote exploitation path has been identified in the description.