CVE-2026-85844: Verify Windows Kerberos Updates

Microsoft describes CVE-2026-85844 as an authentication bypass in Windows Kerberos. An unauthenticated attacker can send specially crafted Kerberos authentication traffic and relay the resulting authentication to an affected domain controller; successful exploitation could grant SYSTEM privileges. No user interaction is required. Microsoft’s November 2026 CVRF listed the issue as not publicly disclosed and not exploited at that release, with exploitation considered less likely for the latest software release. That dated assessment is not proof that an individual domain is safe.

Match product, KB, build, and restart state

The table maps Microsoft’s November 2026 CVRF remediation records to product names, KBs, and fixed builds. Several Windows versions share a KB but have different build thresholds. Verify the product and architecture, not just the KB. Microsoft lists restart as required for the security updates below.

Keep Hotpatch records separate

The same CVRF lists Hotpatch remediations for Windows Server 2025 (KB5131077, build 10.0.26100.33730), Windows 11 24H2 (KB5132043, build 10.0.26100.9911), Windows 11 25H2 (KB5132043, build 10.0.26200.9911), and Windows 11 26H2 (KB5132043, build 10.0.26300.9911). Microsoft marks restart as not required for these Hotpatch records. Do not treat a Hotpatch build as interchangeable with the separate monthly security-update build. Validate the installed update type and current running OS build against the exact product row.

Verify the domain controller after deployment

• Identify Windows version, release, architecture, and server role from the asset. Prioritize domain controllers because Microsoft’s exploitation FAQ describes relaying authentication to an affected DC.
• Match that exact product to its KB and fixed build. Do not infer closure from an update job’s success status or a similarly named workstation.
• After installing the selected update, verify the current running OS build on each domain controller and record whether the chosen update requires a restart.
• Track offline, replicated, disaster-recovery, and maintenance-window systems separately until their running state is verified.

The official Penligent 3.0 video below demonstrates a general AI-assisted testing workflow. It is not a reproduction of CVE-2026-85844 and does not verify a Windows Kerberos update.

Method: AI-assisted review of the Microsoft Security Update Guide and November 2026 CVRF product and remediation records on November 13, 2026. This maps vendor update data; it does not report independent exploit testing or validation of a customer domain.

For broader vulnerability prioritization, see our CVE triage reference. Keep update deployment and running-build evidence in the Windows change record.