CVE-2026-69676

Windows Kerberos Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 54th percentile. A vendor fix is available.

CVSS 3.18.8High EPSS percentile54th0.8% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-08Updated 2026-09-24Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check every affected device for its exact Windows version/build (and whether it is on an older, unpatched branch from the list below).
If you are on Windows 10, update each installation to at least one of these fixed builds: 10.0.14393.9512, 10.0.17763.9245, 10.0.19044.7725, or 10.0.19045.7725.
If you are on Windows 11, update each installation to at least one of these fixed builds: 10.0.22631.7582, 10.0.26100.9445, 10.0.26200.9445, or 10.0.28000.2954.
If you are on Windows Server, update each installation to at least one of these fixed builds: 6.2.9200.26349 (2012), 6.3.9600.23397 (2012 R2), 10.0.14393.9512 (2016), or 10.0.17763.9245 (2019).
Install the update from Microsoft’s guidance page for CVE-2026-69676 (or trigger Microsoft Update/WSUS to pull it), then re-check the installed build number to confirm the fixed version is present.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Authentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network.

In plain language

Written by AI from the record

This is a Windows security flaw that could let an attacker run code over the network by tricking the Windows login system (Kerberos); if you run supported Windows versions and your machines are reachable from other networks, you should act now and install the fixed updates.

CVE-2026-69676 is a Windows Kerberos Remote Code Execution issue involving an authentication bypass via capture-replay, which can let an attacker with low privileges run code over the network if they can reach the Kerberos service and meet the attacker access requirements.

If you're affected

Full system takeover
Malware installation risk
Network-wide compromise risk
Service downtime risk

What is it

Kerberos is the Windows method for verifying who you are when accessing network services. This flaw lets an attacker “replay” captured authentication behavior to get past that check. If that bypass works in your environment, it can lead to running attacker-controlled code on the affected Windows device.

Who is affected

This matters if you run or manage Windows 10, Windows 11, or the listed Windows Server versions and those systems can be reached from a network where an attacker could attempt this attack. The attack needs an “authorized attacker” condition (not just random guessing), so it’s most relevant when someone has network presence and the ability to meet the access/credential requirements.

In practice: only act if the attacker can reach the Kerberos authentication path/service on your machines (for example, through a reachable network) and meet the low-privilege/authorized access requirement.

How urgent is it

This is RED because it’s a Remote Code Execution vulnerability in a core Windows authentication component, which attackers can use to move from authentication tricks to full code execution. Even though no public exploit code is on record yet and it’s not in CISA KEV, the impact is high and Microsoft has provided fixed versions that should be applied immediately.

What to do — in detail

Inventory affected systems

Create a list of all devices running: Windows 10, Windows 11, and the listed Windows Server versions (2012/2012 R2/2016/2019/2022/2025).
Capture each device’s exact Windows version/build number.

Check if each device is already patched

Compare the installed build number to the fixed versions Microsoft lists for this CVE.
Fixed builds from Microsoft (apply the correct ones for your branch):
- Windows 10: 10.0.14393.9512; 10.0.17763.9245; 10.0.19044.7725; 10.0.19045.7725.
- Windows 11: 10.0.22631.7582; 10.0.26100.9445; 10.0.26200.9445; 10.0.28000.2954.
- Windows Server 2012: 6.2.9200.26349.
- Windows Server 2012 R2: 6.3.9600.23397.
- Windows Server 2016: 10.0.14393.9512.
- Windows Server 2019: 10.0.17763.9245.

Upgrade/install the fix

Use Microsoft’s update guidance for CVE-2026-69676:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69676
If you use WSUS/SCCM, approve the relevant update(s) and schedule deployment.
After installation, reboot if required and verify the build number now matches one of the fixed versions above.

If patching must be delayed (temporary risk reduction)

Reduce network exposure to authentication services where possible so an external attacker has fewer opportunities to reach the Kerberos authentication path.
Prioritize patching for internet-reachable or less-segmented systems.

What to monitor after patching

Confirm successful update installation across endpoints and servers.
Review for unusual authentication-related activity during the rollout window and ensure logs are retained for investigation.

KEV timing note

This CVE is not listed in CISA KEV (per the provided findings), so treat Microsoft’s fixed versions as the authoritative remediation path.

Technical context

Severity/impact: High risk remote code execution on Windows systems due to a weakness in how Kerberos authentication can be manipulated.

Weakness: CWE-294 (improper implementation of authentication).

Mechanism/attack vector: The findings indicate an authentication bypass using capture-replay against Windows Kerberos, enabling an attacker with low privileges to execute code over a network when the attacker access conditions are met.

Exploit status: No public exploit code is on record (per findings). KEV is not listed (per findings). Despite prediction-only reach estimates (EPSS provided in source, but not used for public urgency), this is treated as RED due to the nature of the vulnerability and the availability of fixes.

Patch availability: Microsoft provides fixed build versions for multiple Windows 10/11 and several Windows Server branches via the MSRC update guide referenced above.

How KEV relates here: KEV is not present for this CVE in the provided findings, so there is no CISA-confirmed exploitation signal to lean on; remediation should rely on applying Microsoft’s fixed versions.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS54th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.8% chance of exploitation activity in the next 30 days, which ranks it in the 54th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 16 days, from the signal feeds we watch.

2026-09-24Patch availablerecord updated
2026-09-22Patch availablerecord updated
2026-09-10OpenVAS check added
2026-09-09Record updated
2026-09-08Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable