Microsoft Releases Emergency Security Update
Summary: Microsoft released an out-of-band emergency patch, MS14-068, for a flaw in the Windows Kerberos KDC component that authenticates PCs on a local network, after pulling the fix from the prior Patch Tuesday at the last moment. The bug lets an attacker with a valid domain user account forge a Kerberos ticket claiming domain administrator rights, then impersonate any domain account, install programs, or create new accounts, and Microsoft said attackers were already exploiting it in targeted attacks.
Why it matters: An attacker who starts with nothing more than a valid domain user account can escalate to domain administrator and, per Shavlik's Chris Goettl, compromise any computer in the domain including domain controllers - the keys to the kingdom.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026