CVE-2026-47288
HIGH 7.1Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to execute code over an adjacent network.
ELEVATED IMPACT
Severe if exploited (CVSS 7.1), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.5%chance of exploitation in 30 days · 39th percentile
○ In CISA KEV
○ Public exploit / PoC
Impact if exploited
7.1CVSS 3.1 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Must sit on the same / adjacent network
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
✓ lowers the bar for an attacker · ⚠ raises it
Affected
Vendors Microsoft
Products Windows Server 2012 Windows Server 2012 (Server Core Installation) Windows Server 2012 R2 Windows Server 2012 R2 (Server Core Installation) Windows Server 2016 Windows Server 2016 (Server Core Installation) Windows Server 2019 Windows Server 2019 (Server Core Installation)
Weakness (CWE)
- CWE-190: Integer overflow
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C