CVE-2026-27912
Full vulnerability record from the local CVENow database.
Description
Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network.
Severity
HIGH
CVSS score
8.0
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-14 18:16:58.600000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-27912",
"sourceIdentifier": "[email protected]",
"published": "2026-04-14T18:16:58.600",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network."
},
{
"lang": "es",
"value": "Autorización indebida en Windows Kerberos permite a un atacante autorizado elevar privilegios a través de una red adyacente."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Windows Server 2012",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "6.2.9200.0",
"lessThan": "6.2.9200.26026",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2012 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "6.2.9200.0",
"lessThan": "6.2.9200.26026",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2012 R2",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "6.3.9600.0",
"lessThan": "6.3.9600.23132",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2012 R2 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "6.3.9600.0",
"lessThan": "6.3.9600.23132",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2016",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.14393.0",
"lessThan": "10.0.14393.9060",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2016 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.14393.0",
"lessThan": "10.0.14393.9060",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2019",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.17763.0",
"lessThan": "10.0.17763.8644",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2019 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.17763.0",
"lessThan": "10.0.17763.8644",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2022",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.20348.0",
"lessThan": "10.0.20348.5020",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2022, 23H2 Edition (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.25398.0",
"lessThan": "10.0.25398.2274",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2025",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.26100.0",
"lessThan": "10.0.26100.32690",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2025 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.26100.0",
"lessThan": "10.0.26100.32690",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.1,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-13T00:00:00+00:00",
"id": "CVE-2026-27912",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-285"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
"matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.14393.9060",
"matchCriteriaId": "982DB0CA-5196-4E42-B2F7-994BE8179715"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.17763.8644",
"matchCriteriaId": "647CF9B5-8898-469B-9C09-D372A7843187"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.20348.5020",
"matchCriteriaId": "DC6837B7-5DFD-4AF7-B436-3C6FEF48BA60"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.25398.2274",
"matchCriteriaId": "55A1F3AB-5299-4495-9A73-FDA23C6FD88D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.26100.32690",
"matchCriteriaId": "ADF41A14-B9DA-4788-82A8-74DCDCD090E1"
}
]
}
]
}
],
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27912",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}