CVE-2020-17049: Kerberos KDC Security Feature Bypass Vulnerability

Security readout for executives and security teams

CVE-2020-17049 lets a compromised Kerberos Constrained Delegation service bypass a KDC delegation check. The attacker already needs high privilege and a compromised KCD-enabled service, but successful abuse could affect confidentiality, integrity, and availability in Windows Server Kerberos environments. Exposure is most likely in Active Directory environments running affected Windows Server KDCs where Kerberos Constrained Delegation is configured for services. Systems without KCD-enabled services have materially lower practical exposure based on the provided exploit precondition. Treat as a scheduled but important identity-infrastructure fix. It is not evidenced as actively exploited here, but it affects Kerberos delegation controls and could amplify impact after service compromise in Windows Server environments. Mitigation focus: Apply the Microsoft security update for affected Windows Server KDCs.; Check Microsoft advisory guidance for exact supported versions and update status.; Inventory services configured for Kerberos Constrained Delegation..

Prepared

May 24, 2026, 18:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.