Read the docs
TI-2020-13032 Aliases CVE-2020-17049GHSA-g2p3-j47p-8cwj

Kerberos KDC Security Feature Bypass Vulnerability

Priority MEDIUM 49CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.13794 96th percentileScored 2026-11-07
Fix Partial Windows Server 2019 (Microsoft): 10.0.17763.2061Windows Server 2019 (Server Core installation) (Microsoft): 10.0.17763.2061+15 more productsRed Hat: 4 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftWindows Server 201910.0.0 to before 10.0.17763.206110.0.17763.2061Patch availableCNA
MicrosoftWindows Server 2019 (Server Core installation)10.0.0 to before 10.0.17763.206110.0.17763.2061Patch availableCNA
MicrosoftWindows Server, version 1909 (Server Core installation)10.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server, version 1903 (Server Core installation)10.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server version 200410.0.0 to before 10.0.19041.111010.0.19041.1110Patch availableCNA
MicrosoftWindows Server 201610.0.0 to before 10.0.14393.453010.0.14393.4530Patch availableCNA
MicrosoftWindows Server 2016 (Server Core installation)10.0.0 to before 10.0.14393.453010.0.14393.4530Patch availableCNA
MicrosoftWindows Server 2008 Service Pack 26.0.0 to before 6.0.6003.211676.0.6003.21167Patch availableCNA
MicrosoftWindows Server 2008 Service Pack 2 (Server Core installation)6.0.0 to before 6.0.6003.211676.0.6003.21167Patch availableCNA
MicrosoftWindows Server 2008 Service Pack 26.0.0 to before 6.0.6003.211676.0.6003.21167Patch availableCNA
MicrosoftWindows Server 2008 R2 Service Pack 16.1.0 to before 6.1.7601.256616.1.7601.25661Patch availableCNA
MicrosoftWindows Server 2008 R2 Service Pack 1 (Server Core installation)6.0.0 to before 6.1.7601.256616.1.7601.25661Patch availableCNA
MicrosoftWindows Server 20126.2.0 to before 6.2.9200.234096.2.9200.23409Patch availableCNA
MicrosoftWindows Server 2012 (Server Core installation)6.2.0 to before 6.2.9200.234096.2.9200.23409Patch availableCNA
MicrosoftWindows Server 2012 R26.3.0 to before 6.3.9600.200696.3.9600.20069Patch availableCNA
MicrosoftWindows Server 2012 R2 (Server Core installation)6.3.0 to before 6.3.9600.200696.3.9600.20069Patch availableCNA
MicrosoftWindows Server version 20H210.0.0 to before 10.0.19041.111010.0.19041.1110Patch availableCNA
  • Windows Server 2019 VendorMicrosoft Affected 10.0.0 to before 10.0.17763.2061 Fixed in 10.0.17763.2061 Patch available CNA
  • Windows Server 2019 (Server Core installation) VendorMicrosoft Affected 10.0.0 to before 10.0.17763.2061 Fixed in 10.0.17763.2061 Patch available CNA
  • Windows Server, version 1909 (Server Core installation) VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows Server, version 1903 (Server Core installation) VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows Server version 2004 VendorMicrosoft Affected 10.0.0 to before 10.0.19041.1110 Fixed in 10.0.19041.1110 Patch available CNA
  • Windows Server 2016 VendorMicrosoft Affected 10.0.0 to before 10.0.14393.4530 Fixed in 10.0.14393.4530 Patch available CNA
  • Windows Server 2016 (Server Core installation) VendorMicrosoft Affected 10.0.0 to before 10.0.14393.4530 Fixed in 10.0.14393.4530 Patch available CNA
  • Windows Server 2008 Service Pack 2 VendorMicrosoft Affected 6.0.0 to before 6.0.6003.21167 Fixed in 6.0.6003.21167 Patch available CNA
  • Windows Server 2008 Service Pack 2 (Server Core installation) VendorMicrosoft Affected 6.0.0 to before 6.0.6003.21167 Fixed in 6.0.6003.21167 Patch available CNA
  • Windows Server 2008 Service Pack 2 VendorMicrosoft Affected 6.0.0 to before 6.0.6003.21167 Fixed in 6.0.6003.21167 Patch available CNA
  • Windows Server 2008 R2 Service Pack 1 VendorMicrosoft Affected 6.1.0 to before 6.1.7601.25661 Fixed in 6.1.7601.25661 Patch available CNA
  • Windows Server 2008 R2 Service Pack 1 (Server Core installation) VendorMicrosoft Affected 6.0.0 to before 6.1.7601.25661 Fixed in 6.1.7601.25661 Patch available CNA
  • Windows Server 2012 VendorMicrosoft Affected 6.2.0 to before 6.2.9200.23409 Fixed in 6.2.9200.23409 Patch available CNA
  • Windows Server 2012 (Server Core installation) VendorMicrosoft Affected 6.2.0 to before 6.2.9200.23409 Fixed in 6.2.9200.23409 Patch available CNA
  • Windows Server 2012 R2 VendorMicrosoft Affected 6.3.0 to before 6.3.9600.20069 Fixed in 6.3.9600.20069 Patch available CNA
  • Windows Server 2012 R2 (Server Core installation) VendorMicrosoft Affected 6.3.0 to before 6.3.9600.20069 Fixed in 6.3.9600.20069 Patch available CNA
  • Windows Server version 20H2 VendorMicrosoft Affected 10.0.0 to before 10.0.19041.1110 Fixed in 10.0.19041.1110 Patch available CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*r2VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:20h2:*:*:*:*:*:*:*20h2VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*1903VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*1909VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*2004VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*4.1.0 to before 4.13.13; 4.14.0 to before 4.14.9; 4.15.0 to before 4.15.1VulnerableSamba
  • cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:20h2:*:*:*:*:*:*:* Versions 20h2 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:* Versions 1903 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:* Versions 1909 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:* Versions 2004 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* Versions 4.1.0 to before 4.13.13; 4.14.0 to before 4.14.9; 4.15.0 to before 4.15.1 Vulnerable ·Samba

Remediation

  • Fix · CNA Windows Server 2019 (Microsoft) Fixed in 10.0.17763.2061
  • Fix · CNA Windows Server 2019 (Server Core installation) (Microsoft) Fixed in 10.0.17763.2061
  • Fix · CNA Windows Server, version 1909 (Server Core installation) (Microsoft) Fixed in publication
  • Fix · CNA Windows Server, version 1903 (Server Core installation) (Microsoft) Fixed in publication
  • Fix · CNA Windows Server version 2004 (Microsoft) Fixed in 10.0.19041.1110
  • Fix · CNA Windows Server 2016 (Microsoft) Fixed in 10.0.14393.4530
  • Fix · CNA Windows Server 2016 (Server Core installation) (Microsoft) Fixed in 10.0.14393.4530
  • Fix · CNA Windows Server 2008 Service Pack 2 (Microsoft) Fixed in 6.0.6003.21167
  • Fix · CNA Windows Server 2008 Service Pack 2 (Server Core installation) (Microsoft) Fixed in 6.0.6003.21167
  • Fix · CNA Windows Server 2008 Service Pack 2 (Microsoft) Fixed in 6.0.6003.21167
  • Fix · CNA Windows Server 2008 R2 Service Pack 1 (Microsoft) Fixed in 6.1.7601.25661
  • Fix · CNA Windows Server 2008 R2 Service Pack 1 (Server Core installation) (Microsoft) Fixed in 6.1.7601.25661
  • Fix · CNA Windows Server 2012 (Microsoft) Fixed in 6.2.9200.23409
  • Fix · CNA Windows Server 2012 (Server Core installation) (Microsoft) Fixed in 6.2.9200.23409
  • Fix · CNA Windows Server 2012 R2 (Microsoft) Fixed in 6.3.9600.20069
  • Fix · CNA Windows Server 2012 R2 (Server Core installation) (Microsoft) Fixed in 6.3.9600.20069
  • Fix · CNA Windows Server version 20H2 (Microsoft) Fixed in 10.0.19041.1110

Red Hat 4 advisories

  • RHSA-2024:0143 Released 2024-01-10 · Red Hat rating Moderate
    idm:DL1 security update
    • Red Hat Enterprise Linux AppStream (v. 8) bind-dyndb-ldap-11.6-4.module+el8.9.0+18911+94941f82.aarch64::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.9.0+18911+94941f82.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.9.0+18911+94941f82.s390x::idm:DL1 +47
  • RHSA-2024:0139 Released 2024-01-10 · Red Hat rating Moderate
    idm:DL1 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) bind-dyndb-ldap-11.6-4.module+el8.6.0+16878+6c033536.aarch64::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.6.0+16878+6c033536.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.6.0+16878+6c033536.s390x::idm:DL1 +47
  • RHSA-2024:0137 Released 2024-01-10 · Red Hat rating Moderate
    idm:DL1 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) bind-dyndb-ldap-11.6-4.module+el8.8.0+17351+9a3fb056.aarch64::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.8.0+17351+9a3fb056.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.8.0+17351+9a3fb056.s390x::idm:DL1 +47
Show 1 more Red Hat advisories
  • RHSA-2023:2570 Released 2023-05-09 · Red Hat rating Moderate
    krb5 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) krb5-devel-1.20.1-8.el9
    • Red Hat Enterprise Linux BaseOS (v. 9) krb5-1.20.1-8.el9, krb5-libs-1.20.1-8.el9, krb5-pkinit-1.20.1-8.el9 +4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:0143
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:2570
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2024:0139
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:0137
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2023:2570
Not affected: 6 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Core Services
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat Storage 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-17049
  2. 2026-10-03 Alias added: GHSA-g2p3-j47p-8cwj

References

Patch 1

Advisory 2

  • TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01310 Improper input validation in Microsoft Windows Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2017-06077 Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-01465 HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01009 Improper input validation in Microsoft Windows Server KEVCVSS 3.1CRITICAL 9.0
See all 5293 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences