Description
Null pointer dereference in Windows Kerberos allows an unauthorized attacker to deny service over a network.
Published: 2026-09-08
Score: 7.5 High
EPSS: 1.2% Low
KEV: No
Impact: Denial of Service
Action: Apply patch
AI Analysis

Impact

A null pointer dereference in the Windows Kerberos authentication stack allows an unauthorized network attacker to trigger a denial of service. The flaw causes the Kerberos service to crash, which prevents any user from authenticating via Kerberos on the affected host. The impact is limited to authentication failures and loss of service, but can be leveraged to disrupt operations for any user that relies on Kerberos tickets.

Affected Systems

Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows Server 2025 and the Server Core installation of Windows Server 2025 are impacted.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score is 1%, and it is not listed in the CISA KEV catalog. The vulnerability can be exploited over the network by an attacker who can send crafted Kerberos traffic, giving any unauthenticated user the ability to cause the target service to crash. No special privileges are required beyond the ability to contact the Kerberos port.

Generated by OpenCVE AI on September 10, 2026 at 00:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Microsoft security update for CVE-2026-69744 via Windows Update or the Microsoft Update Catalog.
  • Ensure that automatic updates are enabled and that the affected systems receive the patch without delay.
  • If patch deployment is delayed, temporarily block inbound Kerberos traffic by adding a firewall rule to block port 88 or disable the Kerberos Key Distribution Center service until the update is applied.

Generated by OpenCVE AI on September 10, 2026 at 00:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*

Thu, 10 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows Server 2025 (server Core Installation)
Vendors & Products Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows Server 2025 (server Core Installation)

Tue, 08 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Null pointer dereference in Windows Kerberos allows an unauthorized attacker to deny service over a network.
Title Windows Kerberos Denial of Service Vulnerability
First Time appeared Microsoft
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows Server 2025
Weaknesses CWE-476
CPEs cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 Windows 11 25h2 Windows Server 2025 Windows Server 2025 (server Core Installation)
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-09-25T21:32:03.120Z

Reserved: 2026-08-03T22:40:09.685Z

Link: CVE-2026-69744

cve-icon Vulnrichment

Updated: 2026-09-08T20:55:48.808Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-08T18:19:46.630

Modified: 2026-09-22T17:34:42.980

Link: CVE-2026-69744

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T21:09:09Z

Weaknesses