peter bassill · operator
$ cve CVE-2014-6324 JSON

CVE-2014-6324 KEV EXPLOIT

8.8
HIGH · CVSS 3.1 · EPSS 87.3% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-04-15.

Description

The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain users to obtain domain administrator privileges via a forged signature in a ticket, as exploited in the wild in November 2014, aka "Kerberos Checksum Vulnerability."

Scoring

CVSS8.8 (HIGH, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS87.34% — more likely to be exploited than 100% of all CVEs
On CISA KEVyes — remediate by 2022-04-15
Public exploityes
Published2014-11-18
Last modified2026-06-17

CISA KEV

NameMicrosoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability
Added2022-03-25
Due2022-04-15
Vendor / productMicrosoft / Kerberos Key Distribution Center (KDC)
Ransomware usenone reported

Affected (6)

VendorProduct
microsoftwindows 7
microsoftwindows 8
microsoftwindows 8.1
microsoftwindows server 2003
microsoftwindows server 2008
microsoftwindows server 2012

Public exploits

References

→ the Explorer  ·  watch your stack  ·  NVD