PT-2026-2733 · Microsoft · Windows

Andrea Pierini + 3 · Published 2026-01-13 · Updated 2026-04-05 · CVE-2026-20929

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows versions (affected versions not specified)

Description A flaw in Windows HTTP.sys related to improper access control can allow an authorized attacker to elevate privileges over a network. This issue can be exploited remotely. The vulnerability enables Kerberos authentication relay to Active Directory Certificate Services (AD CS) via DNS CNAME abuse, bypassing NTLM protections. A proof-of-concept (PoC) has been released demonstrating how attackers can manipulate DNS CNAME resolution to coerce Windows clients into requesting Kerberos tickets for attacker-controlled Service Principal Names (SPNs), enabling credential relay and lateral movement. This poses a risk to Active Directory networks, even when NTLM is disabled. Mitigation means removing relay opportunities at the service layer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2026-00407

CVE-2026-20929

Affected Products

Windows

References · 14

• https://osv.dev/vulnerability/CVE-2026-20929 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20929 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20929 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-20929 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00407 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-20929 · Security Note
• https://twitter.com/ThreatSynop/status/2013197970582163761 · Twitter Post
• https://twitter.com/decoder_it/status/2011161020455325910 · Twitter Post
• https://twitter.com/DirectoryRanger/status/2040818912502186346 · Twitter Post
• https://twitter.com/DFIR_Radar/status/2039236907607994458 · Twitter Post
• https://twitter.com/IKalendarov/status/2012117962942026144 · Twitter Post
• https://twitter.com/vuldb/status/2011153829266616531 · Twitter Post
• https://reddit.com/r/cybersecurity/comments/1qs50ve/cve202620929_kerberos_authentication_relay_via · Reddit Post
• https://twitter.com/CVEnew/status/2011181509064130891 · Twitter Post