The Windows Kerberos elevation vulnerability arises from a reliance on untrusted input during a security decision. An authorized attacker who can reach the network may exploit this flaw to gain elevated privileges, potentially accessing sensitive data and modifying system configurations. This weakness is classified as CWE-807, indicating that untrusted data was used to make a security decision.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3; Windows Server 2008 R2 SP1 and SP1 (Server Core); Windows Server 2008 SP2 and SP2 (Server Core); Windows Server 2012, 2012 R2 (both Server Core); Windows Server 2016, 2019, 2022, 2025 and the 23H2 Server editions (both Core and full installations).

With a CVSS score of 7.5, the flaw is high severity, yet the EPSS score of less than 1% suggests low exploitation probability. It is not listed in the CISA KEV catalog. The likely attack vector is a network-based exploitation where an attacker with legitimate but non‑privileged credentials sends crafted Kerberos traffic to induce the improper security decision, culminating in privilege elevation to an administrator or domain administrator level. No specific exploit payload is described, so an attacker must generate a malformed Kerberos request or manipulate ticket contents to trigger the vulnerability.