Authentication bypass by capture-replay in Windows Kerberos

CVE-2026-69676 is a remote code execution vulnerability in the Windows Kerberos authentication protocol. An attacker holding any low-privileged domain credential — the kind you get from a single phished helpdesk intern — can craft a modified Kerberos authentication exchange, replay it to a domain controller, and achieve arbitrary code execution on that DC. The flaw affects all supported Windows Server versions running the Kerberos KDC role (Server 2016, 2019, 2022, and 2025). Microsoft disclosed the bug as part of the September 2026 Patch Tuesday cycle and rates exploitation as "More Likely."

Microsoft's vendor CVSS of 8.8 HIGH undersells this vulnerability. The 8.8 score is mechanically correct for AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, but the S:U (Scope: Unchanged) designation ignores what "the affected component" actually is: a domain controller. Code execution on a DC *is* domain compromise — the attacker gets NTDS.dit, every Kerberos key, and the ability to forge Golden Tickets for the entire forest. The blast radius is not one host; it is every identity in the organization. This is a CRITICAL vulnerability that demands emergency treatment.

Why this verdict

• PR:L is trivially satisfied: The only prerequisite is a single domain user credential — obtainable via phishing, credential stuffing, or broker purchase. This is not a meaningful friction point; it is the starting position of virtually every enterprise intrusion.
• Zero network friction: Every domain-joined host must be able to reach DCs on port 88 for Kerberos to function. There is no network segmentation that blocks this without breaking AD authentication entirely.
• Role multiplier — domain controllers are THE canonical high-value identity target: The affected component (Kerberos KDC) runs exclusively on DCs. 100% of installs of this component occupy the highest-value role by definition. A successful chain yields NTDS.dit extraction, krbtgt compromise, and Golden Ticket forgery — this is domain takeover → fleet compromise. Per noisgate floor rules, this is a CRITICAL floor.
• Microsoft expects exploitation: The "Exploitation More Likely" assessment, combined with the maturity of existing Kerberos attack tooling (Impacket, Rubeus), means weaponization is a matter of when, not if. Kerberos replay attacks have been a preferred technique in ransomware intrusions.
• Scope:Unchanged is misleading: The CVSS vector uses S:U, which mechanically caps the base score at 8.8. But code execution on a DC is not "unchanged scope" in any meaningful operational sense — the blast radius is the entire AD forest, every identity, every domain-joined host.

Why not higher?

A 10.0 would require unauthenticated access (PR:N) and no prerequisites whatsoever. This vulnerability does require one valid low-privileged credential, which represents a real (if thin) barrier. Additionally, there is no confirmed active exploitation or public PoC yet, so the immediacy of the threat is slightly below a wormable unauthenticated RCE.

Why not lower?

Downgrading below CRITICAL is not defensible. The target component is the Kerberos KDC, which by definition only runs on domain controllers — 100% of affected installs are in the highest-value identity role. The chain from any domain user to full domain compromise has zero network friction and trivially satisfied prerequisites. The blast radius is forest-wide identity takeover. Per noisgate floor rules, when the affected component canonically occupies the high-value identity role and the outcome is domain takeover, the verdict floor is CRITICAL regardless of the PR:L friction point.

1. Emergency-patch all domain controllers within 72 hours — This is the only definitive fix. DCs should be the first hosts patched — not last. Under the noisgate mitigation SLA for CRITICAL, deploy within 3 days. Coordinate with your AD team for staged DC reboots to maintain quorum.
2. Deploy Talos Snort rules on network sensors covering DC traffic — Apply Snort 2 SIDs 67011-67032, 67036-67084 and Snort 3 SIDs 301619-301629, 301632-301655 on IDS/IPS sensors monitoring traffic to DCs. This provides detection and potential blocking of exploitation attempts while patching is in progress.
3. Enable enhanced Kerberos logging on all DCs — Enable Windows Event IDs 4768, 4769, 4771 at verbose level and forward to SIEM. Configure alerts for anomalous TGS-REQ patterns, replay indicators, and unexpected ticket lifetimes. This won't prevent exploitation but gives you visibility.
4. Harden DC process monitoring via EDR — Ensure EDR agents on DCs are configured with high-fidelity rules for unexpected child processes of lsass.exe and anomalous SYSTEM-context process creation. This detects post-exploitation activity if the replay succeeds.
5. Audit and reduce domain user population — Disable or remove unnecessary domain accounts (service accounts with interactive logon, stale user accounts, test accounts). Every valid credential is a potential entry point. Reducing the credential surface area limits the pool of accounts an attacker can leverage.

Run on each domain controller as a local administrator. Execute: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-69676.ps1. The script checks whether the September 2026 cumulative update has been applied by examining the OS build number against the patched baseline.

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Checks whether CVE-2026-69676 (Windows Kerberos capture-replay RCE) is patched.
.DESCRIPTION
    Verifies the September 2026 cumulative update is installed by checking
    the OS build revision against known patched baselines.
    Run on each Domain Controller as Administrator.
.OUTPUTS
    VULNERABLE, PATCHED, or UNKNOWN with exit codes 1, 0, 2.
#>

$ErrorActionPreference = 'Stop'

# September 2026 Patch Tuesday patched build revisions (minimum)
# These are approximate baselines; adjust KB-specific revisions as Microsoft publishes them
$patchedBuilds = @{
    # Server 2016 (build 14393)
    14393 = 8200
    # Server 2019 (build 17763)
    17763 = 7100
    # Server 2022 (build 20348)
    20348 = 5600
    # Server 2025 (build 26100)
    26100 = 3200
}

try {
    $os = Get-CimInstance Win32_OperatingSystem
    $build = [System.Environment]::OSVersion.Version.Build
    $revision = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name UBR).UBR
    $isDC = (Get-CimInstance Win32_ComputerSystem).DomainRole -ge 4

    Write-Host "Host:        $($env:COMPUTERNAME)"
    Write-Host "OS:          $($os.Caption)"
    Write-Host "Build:       $build.$revision"
    Write-Host "Domain Role: $(if ($isDC) { 'Domain Controller' } else { 'Member Server / Workstation' })"
    Write-Host '---'

    if (-not $isDC) {
        Write-Host '[INFO] This host is not a Domain Controller. The critical attack path targets DCs.'
        Write-Host '[INFO] Checking patch status anyway as Kerberos clients are also affected.'
    }

    if ($patchedBuilds.ContainsKey($build)) {
        $requiredRevision = $patchedBuilds[$build]
        if ($revision -ge $requiredRevision) {
            Write-Host "PATCHED - Build $build.$revision meets or exceeds patched baseline $build.$requiredRevision"
            exit 0
        } else {
            Write-Host "VULNERABLE - Build $build.$revision is below patched baseline $build.$requiredRevision"
            Write-Host 'ACTION: Apply the September 2026 cumulative update immediately on this DC.'
            exit 1
        }
    } else {
        # Check for September 2026 KB via hotfix history as fallback
        $septKBs = Get-HotFix | Where-Object { $_.InstalledOn -ge [datetime]'2026-09-08' } | Select-Object -ExpandProperty HotFixID
        if ($septKBs.Count -gt 0) {
            Write-Host "UNKNOWN - Unrecognized build $build but recent KBs found: $($septKBs -join ', ')"
            Write-Host 'Verify manually that the September 2026 cumulative update is among them.'
            exit 2
        } else {
            Write-Host "VULNERABLE - Unrecognized build $build.$revision with no September 2026 patches detected."
            exit 1
        }
    }
} catch {
    Write-Host "UNKNOWN - Error during check: $_"
    exit 2
}

Sources

1. CrowdStrike September 2026 Patch Tuesday Analysis
2. Tenable September 2026 Patch Tuesday Coverage
3. Cisco Talos September 2026 Snort Rules
4. Help Net Security – September 2026 Patch Tuesday Analysis
5. Qualys September 2026 Patch Tuesday Review
6. Alexander Leonov September 2026 Patch Tuesday Recap
7. IT-Connect September 2026 Patch Tuesday Summary
8. MITRE CWE-294: Authentication Bypass by Capture-Replay