CVE-2026-27912

CVE Enrichment

CVSS: 8.0 HIGH
EPSS: 0.43%
EPSS Percentile: 35.11%
CISA KEV: Not listed

Description

Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: secure@microsoft.com
Published: 15-Apr-2026 01:16
Last Modified: 17-Jun-2026 17:27
EPSS Date: 2026-10-12
CWE: CWE-285

CVSS Vector


            CVSS:3.1                            AV:A /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

microsoft / windows_server_2012
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
microsoft / windows_server_2012
Version / affected range: r2
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
microsoft / windows_server_2016
Version / affected range: * · before (exclusive) 10.0.14393.9060
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
microsoft / windows_server_2019
Version / affected range: * · before (exclusive) 10.0.17763.8644
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
microsoft / windows_server_2022
Version / affected range: * · before (exclusive) 10.0.20348.5020
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
microsoft / windows_server_2022_23h2
Version / affected range: * · before (exclusive) 10.0.25398.2274
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
microsoft / windows_server_2025
Version / affected range: * · before (exclusive) 10.0.26100.32690
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*

References

secure@microsoft.com

Last enrichment sync: 12-Oct-2026 23:51
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

ResetNightmare (CVE-2026-27912) requires an attacker-writable or new user or computer object and a target past minimum password age. An attacker sets the target’s bare sAMAccountName as an object’s UPN, requests an Black Hat and DEF CON Roundup: Hugging Face Compromise, North Korean Operations and Security Funding

CVE (2)

Malware (1)

People (5)

Vendors (23)

Products (34)

Tools (4)

Industries (3)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.