Windows Kerberos authentication bypass allows network elevation of privilege (CVE-2026-85844)

What happened

CVE-2026-85844 is an authentication bypass in Windows Kerberos. Microsoft describes the flaw as permitting an unauthorised attacker to elevate privileges over a network by using an alternate path or channel. The CVSS 3.1 vector is network-based with low attack complexity, no privileges and no user interaction; the score is 9.8 Critical, with high impact on confidentiality, integrity and availability. Microsoft's advisory rating is Important.

In practice, an attacker who can reach a Kerberos-relying Windows host does not need credentials or a user to act before obtaining elevated privileges. The CVE record does not report public disclosure or active exploitation.

Who is affected

Microsoft's update guide covers Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations where listed. In each case, systems running builds before the fixed versions below are affected. These are common domain authentication and application servers, so domain controllers and other Kerberos-relying hosts are the priority.

What to do now

1. Apply the November 2026 security update. Fixed builds include:

• Windows 10 version 1607: 10.0.14393.9688; version 1809: 10.0.17763.9487; version 21H2: 10.0.19044.7846; version 22H2: 10.0.19045.7846
• Windows 11 version 23H2: 10.0.22631.7711; version 24H2: 10.0.26100.9974; version 25H2: 10.0.26200.9974; version 26H1: 10.0.28000.3501; version 26H2: 10.0.26300.9974
• Windows Server 2012: 6.2.9200.26434; 2012 R2: 6.3.9600.23470; 2016: 10.0.14393.9688; 2019: 10.0.17763.9487; 2022: 10.0.20348.5870; 2025: 10.0.26100.33822

1. Microsoft has not published a workaround; if immediate patching is not possible, restrict network access to Kerberos authentication and domain services. See Microsoft's security update guide for the complete build-to-KB mapping.

How to detect it

Microsoft has not published indicators of compromise for this vulnerability. Because the flaw bypasses Kerberos authentication over the network without credentials, security teams should review domain controller authentication logs for unexpected privilege changes or ticket-granting activity from untrusted sources.

Beyond the patch

Beyond patching, this flaw is a test of how quickly you can locate every Windows build in the estate and push a critical update before an exposed host is abused. Because it is reachable over the network with no credentials, Virtual CISO Services (vCISO) helps keep that exposure visible, while Managed Detection & Response (MDR) watches for the privilege escalation and credential abuse that follow an authentication bypass. If a managed service provider or subsidiary owns part of your patch cycle, Supply Chain Defense & Third-Party Risk helps track that exposure window.