CVE-2026-24297

MEDIUM

Windows 10/Server 2012/2016 Kerberos Race Condition Security Feature Bypass

Title source: llm
STIX 2.1

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kerberos allows an unauthorized attacker to bypass a security feature over a network.

References (1)

Core 1
Core References

Scores

CVSS v3 6.5
EPSS 0.0035
EPSS Percentile 26.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-362
Status published
Products (20)
Microsoft/Windows 10 Version 1607 10.0.14393.0 - 10.0.14393.8957
Microsoft/Windows 10 Version 1809 10.0.17763.0 - 10.0.17763.8511
Microsoft/Windows 10 Version 21H2 10.0.19044.0 - 10.0.19044.7058
Microsoft/Windows 10 Version 22H2 10.0.19045.0 - 10.0.19045.7058
Microsoft/Windows Server 2012 6.2.9200.0 - 6.2.9200.25973
Microsoft/Windows Server 2012 (Server Core installation) 6.2.9200.0 - 6.2.9200.25973
Microsoft/Windows Server 2012 R2 6.3.9600.0 - 6.3.9600.23074
Microsoft/Windows Server 2012 R2 (Server Core installation) 6.3.9600.0 - 6.3.9600.23074
Microsoft/Windows Server 2016 10.0.14393.0 - 10.0.14393.8957
Microsoft/Windows Server 2016 (Server Core installation) 10.0.14393.0 - 10.0.14393.8957
... and 10 more
Published Mar 10, 2026
Tracked Since Mar 11, 2026