CVE-2026-27912

🎯 CVE-2026-27912 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-27912 | Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network.

Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network.

Klassifikation & Betroffenheit:

CWE-285 Microsoft Windows Server 2025 10.0.26100.0 <10.0.26100.32690Windows Server 2016 10.0.14393.0 <10.0.14393.9060Windows Server 2012 R2 6.3.9600.0 <6.3.9600.23132Windows Server 2022 10.0.20348.0 <10.0.20348.5020Windows Server 2019 (Server Core installation) 10.0.17763.0 <10.0.17763.8644Windows Server 2019 10.0.17763.0 <10.0.17763.8644Windows Server 2012 (Server Core installation) 6.2.9200.0 <6.2.9200.26026Windows Server 2012 R2 (Server Core installation) 6.3.9600.0 <6.3.9600.23132

Improper Authorization 🎯 High

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

🛡️ Empfohlene Mitigation: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authoriza…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-1 · Accessing Functionality Not Properly Con… (High) CAPEC-13 · Subverting Environment Variable Values (Very High) CAPEC-17 · Using Malicious Files (Very High) CAPEC-39 · Manipulating Opaque Client-based Data To… (Medium) CAPEC-45 · Buffer Overflow via Symbolic Links (High) CAPEC-104 · Cross Zone Scripting (High) CAPEC-127 · Directory Indexing (Medium) CAPEC-402 · Bypassing ATA Password Security

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1574.010 · Hijack Execution Flow: ServicesFil… T1562.003 · Impair Defenses:Impair Command His… T1574.006 · Hijack Execution Flow:Dynamic Link… T1574.007 · Hijack Execution Flow:Path Interce… T1574.005 · Hijack Execution Flow: Executable … T1083 · File and Directory Discovery

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-88092 9.4 CVE-2026-73296 9.4 CVE-2026-50516 9.4 CVE-2026-33950 9.4 CVE-2026-28806 9.4

🧪 Exploit-Evidenz:

🐙 Semperis-Community/ResetNightmar 🐙 mihat2/ResetNightmare-impacket 🐙 oxstussz-eng/Kerberos-CVE-2026-2

🇩🇪 BSI-Sicherheitshinweise: BSI · kritisch · Microsoft Windows: Mehrere Schwachstellen ↗

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

🔗 msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27912

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 04/2026

Heute 09.11.

CVSS-Vektor-Analyse: 8.0

AV · Angriffsvektor Benachbart

AC · Komplexität Gering

PR · Privilegien Gering

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CNA-Bewertung (microsoft): 8.0 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E…

Veröffentlicht:14.04.2026

Aktualisiert:26.10.2026 21:10

Assigner (CNA):microsoft

EUVD-ID:EUVD-2026-22453

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-285 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Patch-Tuesday Update einspielen oder betroffene Dienste in Windows Defender isolieren.

Tier	CVEs	Anteil
≥90 %	785	0,2 %
≥50 %	3.559	0,9 %
≥10 %	13.139	3,2 %
<10 %	396.072	95,8 %

Tier

CVEs

Anteil

≥90 %

785

0,2 %

≥50 %

3.559

0,9 %

≥10 %

13.139

3,2 %

<10 %

396.072

95,8 %

CVE-2026-27912 | Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network.

Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network.

CWE-285 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Patch-Tuesday Update einspielen oder betroffene Dienste in Windows Defender isolieren.

CVE-2026-27912 | Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network.

Zero-Day & Vulnerability Intelligence Hub

CVE-2026-27912 | Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network.