CVE-2026-62752: Windows Kerberos Security Authority Elevation of Privilege

HERMES

HERMES THREAT SCORE & LOCAL SECURITY AUTHORITY HIJACKING

Target: Windows Kerberos Security Support Provider (kerberos.dll / lsass.exe)

Confidence: 96%

89 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 16 / 20

Weaponization 17 / 20

Exposure 18 / 20

Prevalence 20 / 20

Impact 19 / 20

Exploit Maturity 17 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-62752 at 7.8 (HIGH, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The Hermes Threat Score elevates operational severity to 89 (HIGH) due to universal presence on every Windows workstation, server, and domain controller, providing attackers with a reliable local elevation primitive to SYSTEM.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-62752: Windows Kerberos Security Authority Elevation of PrivilegeVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Local Privilege Elevation Alert: Kerberos SSP Heap Overflow

CVSS v3.1 : 7.8 HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) / CWE-122: Heap-based Buffer Overflow. Addressed in Microsoft’s August 2026 Patch Tuesday, affecting the core Windows Kerberos Authentication Package across all Windows OS versions.

Executive Summary

CVE-2026-62752 is a local elevation of privilege vulnerability residing in kerberos.dll, executed within the Local Security Authority Subsystem Service (lsass.exe). A low-privileged local user submitting a malformed Kerberos ticket cache purge or ticket injection request via the LsaCallAuthenticationPackage API can trigger a heap-based buffer overflow, hijacking execution flow to achieve full NT AUTHORITY\SYSTEM access.

---

1. Technical Context & Affected Software Matrix

The Windows Kerberos Security Support Provider (kerberos.dll) is the primary authentication provider for Windows domain members and domain controllers.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2026-62752	MSRC Bulletin August 2026
Vulnerable Component	Windows Kerberos SSP (kerberos.dll / lsass.exe)	Core Local Security Authority (LSA) subsystem
CWE Weakness	CWE-122: Heap-based Buffer Overflow	Unbounded memory copy during ticket cache enumeration
CVSS v3.1 Score	7.8 (HIGH / Hermes Operational Severity 89)	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector	Local authenticated user / service account	Local elevation of privilege (LPE)
Affected Platforms	Windows 10, Windows 11 (22H2-24H2), Windows Server 2019, 2022, 2025	Universal deployment across all Windows hosts
Microsoft Patches	Cumulative Updates August 2026 (KB5041580, KB5041585, KB5041592)	Standard high-priority deployment

---

2. In-Depth Technical Decomposition & Root Cause

When user applications interact with Kerberos tickets (such as querying cached tickets via KerbQueryTicketCacheExMessage or purging tickets via KerbPurgeTicketCacheMessage), the requests are handled by LsaCallAuthenticationPackage.

In kerberos.dll, the routine unpacking the caller’s target service name fails to enforce boundary checks when calculating the allocated buffer length for wide-character realm strings:

// Conceptual vulnerable logic in kerberos.dll ticket cache handler
NTSTATUS KerbExtractRealmName(
    PKERB_QUERY_TKT_CACHE_REQUEST pRequest,
    ULONG cbRequestLength,
    PUNICODE_STRING pDestinationRealm
) {
    // Integer truncation when calculating allocation size
    USHORT cbAllocSize = (USHORT)(pRequest->RealmNameLength * sizeof(WCHAR));

    // If RealmNameLength is crafted such that cbAllocSize wraps or misallocates:
    PWSTR pwszBuffer = (PWSTR)LsaFunctions->AllocateLsaHeap(cbAllocSize);
    if (!pwszBuffer) return STATUS_INSUFFICIENT_RESOURCES;

    // VULNERABILITY: Raw copy exceeds allocated heap chunk size!
    RtlCopyMemory(pwszBuffer, pRequest->RealmNameBuffer, pRequest->RealmNameLength * sizeof(WCHAR));

    pDestinationRealm->Buffer = pwszBuffer;
    pDestinationRealm->Length = cbAllocSize;
    return STATUS_SUCCESS;
}

Because lsass.exe runs with process protection and highest system privileges, corrupting adjacent heap chunks allows arbitrary function pointer overwrites, resulting in arbitrary shellcode execution as NT AUTHORITY\SYSTEM.

---

3. Attack Vectors & Enterprise Threat Scenarios

[ Low-Privilege Local Compromise (Phishing / Web Shell) ]
               │
               ▼ (LsaCallAuthenticationPackage / kerberos.dll)
[ Trigger CVE-2026-62752 Heap Buffer Overflow in lsass.exe ]
               │
               ▼ (Code Execution under NT AUTHORITY\SYSTEM)
[ Extract Kerberos TGTs & NTLM Hashes from Memory ]
               │
               ▼ (Pass-the-Hash / Overpass-the-Hash)
[ Lateral Movement across Domain / Forest ]

Forensic Correlation with Active Directory Corpus

• NTLM vs Kerberos Investigation: Understanding how Kerberos tickets are requested, stored in LSA memory, and abused. See AD-21: NTLM vs Kerberos investigation fundamentals.
• PAC Structure & Validation: Privilege validation within the Kerberos ticket structure and how LSA validates PAC signatures. See AD-22: Kerberos PAC structure, validation and forgery.
• Golden and Silver Tickets: Elevating to SYSTEM on a DC or service machine allows extracting Kerberos keys (krbtgt or service SPNs). See AD-27: Golden Ticket vs Silver Ticket.

---

4. Forensic Detection, Artefacts & Event IDs

Detecting CVE-2026-62752 exploitation requires monitoring LSA heap integrity and anomalous process injection:

Key Event IDs & Artefacts

• Security Event ID 4672 (“Special privileges assigned to new logon”): Unexpected privilege assignment (SeDebugPrivilege, SeTcbPrivilege) right after a low-privilege user session.
• System Event ID 1000 / Error Reporting: Crash logs of lsass.exe with exception code 0xc0000374 (STATUS_HEAP_CORRUPTION) indicating exploitation attempts.
• Sysmon Event ID 10 (ProcessAccess): Abnormal open handles to lsass.exe with PROCESS_VM_WRITE or PROCESS_VM_OPERATION access masks.

Detection Rule (Splunk / Elastic / Sigma)

title: Potential LSA Heap Overflow via Kerberos Package
status: experimental
description: Detects LSASS heap corruption or abnormal thread creation originating from kerberos.dll
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 1000
    Source: 'Application Error'
    FaultingApplication: 'lsass.exe'
    FaultingModule: 'kerberos.dll'
    ExceptionCode: '0xc0000374'
  condition: selection
level: critical

---

5. Remediation, Hardening & Defensive Engineering

1. Apply Security Updates: Deploy August 2026 cumulative updates across all endpoints.
2. Enable LSA Protection (RunAsPPL): Configure RunAsPPL=1 and RunAsPPLBoot=1 in HKLM\SYSTEM\CurrentControlSet\Control\Lsa to prevent unauthorized code injection into lsass.exe.
3. Enable Credential Guard: Use Virtualization-Based Security (VBS) to isolate Kerberos keys in an isolated microkernel environment.