Weak Authentication in Microsoft Windows and Windows Server - CVE-2026-122164
Published: November 11, 2026
Vulnerability identifier: #VU165447
CSH Severity: Low
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-122164
CWE-ID: CWE-1390
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to elevate an identity's integrity level to System and bypass integrity-level restrictions.
The vulnerability exists due to weak authentication in Windows Kerberos when processing authentication information from a trusted forest. A remote privileged user can control authentication in that forest and send specially crafted authentication information to the target forest to elevate the identity's integrity level.
Exploitation requires existing resource permissions that allow the identity access. It does not grant SYSTEM-account privileges or target-forest administrator membership.
Affected software
Microsoft Windows
Windows Server
Windows Server
How to mitigate CVE-2026-122164
Install security update from vendor's website.
Microsoft Windows - addressed in versions 10 21H2 10.0.19044.7846, 10 22H2 10.0.19045.7846, 10 1607 10.0.14393.9688, 10 1809 10.0.17763.9487, 11 23H2 10.0.22631.7711, 11 24H2 10.0.26100.9911, 11 24H2 10.0.26100.9974, 11 25H2 10.0.26200.9911, 11 25H2 10.0.26200.9974, 11 26H1 10.0.28000.3501
Windows Server - addressed in versions 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33730, 2025 10.0.26100.33822
Windows Server - addressed in versions 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33730, 2025 10.0.26100.33822