Concurrent execution using a shared resource with improper synchronization – a race condition – in Windows Kerberos allows an attacker to bypass a security feature over a network. This vulnerability can lead to unauthorized access because the attack disrupts normal Kerberos authentication checks, thereby compromising confidentiality, integrity, and availability of the authentication process. The weakness is classified as CWE-362 (Race Condition).

The vulnerability affects Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019, including their Server Core installations.

The CVSS base score is 6.5, indicating medium severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further indicating a moderate overall risk. Exploitation requires a remote attacker to cause concurrent Kerberos operations that trigger the race condition, typically from another system within the same domain. No additional exploits or conditions are currently documented.