Kerberos

Kerberos is the default authentication protocol for Windows domain environments, designed at MIT in the 1980s and adopted by Microsoft for Active Directory from Windows 2000 onwards. It uses a trusted third party (the Key Distribution Centre, or KDC) running on domain controllers to issue time-limited cryptographic tickets that allow users and services to authenticate without transmitting passwords across the network. In June 2026 Microsoft patched CVE-2026-47288, a Remote Code Execution vulnerability in the Windows KDC component that reached domain controller authentication, one of the highest-value targets in any Windows enterprise network.

Kerberos vulnerabilities in Windows implementations have a long history: MS14-068 (2014) allowed any authenticated user to forge Kerberos tickets with domain administrator privileges, while the Golden Ticket and Silver Ticket techniques discovered by security researcher Benjamin Delpy remain active post-exploitation staples. The protocol's design means the KDC is inherently network-reachable from every domain-joined machine, so a Remote Code Execution flaw on the KDC has no requirement for physical access or a pre-existing foothold on the target server. Successful exploitation compromises the entire Windows domain.

Kerberos operates across platforms beyond Windows: Linux systems using Samba or MIT Kerberos, macOS in enterprise environments, and cross-realm trusts spanning cloud directories all rely on Kerberos or its derivative protocols. Windows-specific KDC flaws do not directly affect non-Windows KDC implementations, but the overlap matters for organisations running hybrid authentication environments where a Windows domain controller issues tickets consumed by Linux or macOS clients.