Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 11 products
| Date | Total | Labels |
|---|
| 2026-03-31 | 1 | Disclosure1 |
| 2026-04-01 | 2 | Disclosure1General1 |
| 2026-04-05 | 1 | General1 |
| 2026-04-09 | 1 | Disclosure1 |
| 2026-04-12 | 1 | Patch1 |
| 2026-06-05 | 1 | Disclosure1 |
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse https://www.crowdstrike.com/en-us/blog/detecting-kerberos-relay-attack-via-dns-cname-abuse/
Post summary
The article highlights detection of CVE‑2026‑20929, a Kerberos authentication relay via CNAME abuse, providing technical details but no evidence of exploitation, PoC, or patch information.
CVE-2026-20929 (CVSS 7.5) enables Kerberos authentication relay to AD CS via DNS CNAME abuse, bypassing NTLM protections. CrowdStrike detection monitors for anomalous cert-based auth + unusual AD CS access patterns. #DFIR_Radar https://t.co/YKHJtsUJQK
Post summary
The tweet announces CVE‑2026‑20929, detailing its high‑severity nature and exploitation vector (Kerberos relay via DNS CNAME abuse), while noting CrowdStrike’s detection of anomalous authentication patterns.
CVE-2026-20929 allows attackers to exploit Kerberos via CNAME abuse, leading to authentication relay attacks. This vulnerability bypasses existing defenses—patch now to prevent unauthorized access. #NerdieNews #CyberSecurity #InfoSec #ThreatIntel #APT https://t.co/Hi4LEb2osP
Post summary
The tweet announces CVE-2026-20929, highlights its Kerberos-based CNAME abuse leading to authentication relay attacks, and urges users to apply the patch to prevent unauthorized access.
ADCS ESC8: skipping EPA=Required keeps NTLM relay open. CVE-2026-20929 adds Kerberos CNAME relay to the same endpoint - no NTLM needed. Detection: Event 4886 within seconds of auth from unexpected IP. T1649→T1003.006. Two blind spots, one chain to domain compromise.
Post summary
The text discloses technical details of CVE-2026-20929, describing a Kerberos CNAME relay vulnerability, detection methods, and potential attack chains, without presenting a PoC, exploit code, or patch information.
🚩 CVE-2026-20929: Turning Kerberos into a Relay Vector via DNS https://www.crowdstrike.com/en-us/blog/detecting-kerberos-relay-attack-via-dns-cname-abuse/ CVE-2026-20929 shows how DNS CNAME abuse can turn Kerberos into a relay vector, even in environments where NTLM is disabled. By targeting AD CS, attackers can issue certificates for user accounts and gain long-term access without relying on passwords. Detection now focuses on correlating unusual certificate authentication with abnormal service access patterns. If missed, this can lead to persistent, stealthy compromise inside Active Directory environments. #DNS #DNSSecurity #InfoSec
Post summary
The article announces CVE‑2026‑20929, explaining how DNS CNAME abuse can transform Kerberos into a relay vector and outlines detection strategies, but no exploits, patches, or active attack reports are mentioned.
Detecting CVE-2026-20929: Kerberos Relay via CNAME Abuse ⭕️ Researchers identify methods to detect Kerberos authentication relay exploiting CNAME abuse. https://t.co/IENRDOdfrA
Post summary
Researchers have published detection methods for CVE-2026-20929, a Kerberos relay vulnerability via CNAME abuse, but the post provides no PoC, exploit code, patch, or evidence of active exploitation.
🚨 CVE-2026-20929 Kerberos relay via DNS CNAME (HTTP.sys) (Credential relay / auth-bypass) Microsoft Windows HTTP.sys (HTTP Server API) | CVSS 7.5 | Auth https://threatlevel.io/CVE-2026-20929 #EmergencyFix #CVE #cybersecurity
Post summary
The tweet announces CVE-2026-20929, a Windows HTTP.sys vulnerability that permits Kerberos credential relay via DNS CNAME, rated CVSS 7.5, but it provides no PoC, exploit, or mitigation information.
16 of 16 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | microsoft | windows_10_1607 | - | - | x64 |
| OS | microsoft | windows_10_1607 | - | - | x86 |
| OS | microsoft | windows_10_1809 | - | - | x64 |
| OS | microsoft | windows_10_1809 | - | - | x86 |
| OS | microsoft | windows_10_21h2 | - | - | - |
| OS | microsoft | windows_10_22h2 | - | - | - |
| OS | microsoft | windows_11_23h2 | - | - | - |
| OS | microsoft | windows_server_2008 | - | - | x64 |
| OS | microsoft | windows_server_2008 | - | - | x86 |
| OS | microsoft | windows_server_2008 | r2 | - | x64 |
| OS | microsoft | windows_server_2012 | - | - | - |
| OS | microsoft | windows_server_2012 | r2 | - | - |
| OS | microsoft | windows_server_2016 | - | - | - |
| OS | microsoft | windows_server_2019 | - | - | - |
| OS | microsoft | windows_server_2022 | - | - | - |
| OS | microsoft | windows_server_2022_23h2 | - | - | - |