{"id":"CVE-2026-85844","published":"2026-11-10T19:21:25.653","lastModified":"2026-11-11T05:19:53.740","description":"Authentication bypass using an alternate path or channel in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-288"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85844","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A flaw in Windows Kerberos allows authentication bypass via an alternate path or channel, enabling unauthorized privilege escalation over the network. This is a critical weakness (CWE-288) that undermines core identity controls.","exploitability":"Exploitation requires no user interaction, low privileges, and can be performed remotely; however, no public exploit code or detailed methodology is available, suggesting high technical complexity despite the CVSS score.","blast_radius":"Successful exploitation could allow an unauthenticated or low-privileged attacker to gain full system control on domain-joined Windows systems, potentially compromising the entire Active Directory forest.","remediation":"No fixed version or patch level is specified in the published description; apply Microsoft security updates as soon as they are released, and enforce Kerberos constrained delegation policies strictly per vendor guidance.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","privilege-escalation","kerberos","active-directory","network-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:51:17.898Z"}}