Microsoft Windows Kerberos Information Disclosure Vulnerability

A vulnerability in Windows Kerberos allows an authorized attacker to locally disclose information by exploiting the use of a broken or risky cryptographic algorithm. This issue affects several versions of Windows Server, including 2008, 2012, 2016, 2019, 2022, and 2025, as well as Windows Server 2022 23H2 Edition.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure, specifically secrets or privileged information belonging to the user of the affected application.

Remediation

Users can apply the security update for this vulnerability, which is included in the January 2026 Monthly Rollup for all affected Windows Server versions. Instructions for downloading this update are available on the Microsoft Update Catalog.