VulnSocial

CVE-2026-57915Disclosure

LOWCVSS 7.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-304CWE-358

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-06-27); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-27: 1Mentions · 2026-06-28: 1Patch / Workaround · 2026-06-27: 1Technical Details · 2026-06-27: 1Technical Details · 2026-06-28: 106-2706-28
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    CVE-2026-57914: Apache Kerby: StackOverflow on parsing deeply nested ASN1 structures https://www.openwall.com/lists/oss-security/2026/06/26/7 CVE-2026-57915: Apache Kerby: Kerberos Pre-Authentication Bypass https://www.openwall.com/lists/oss-security/2026/06/26/8 Apache Kerby is a Java Kerberos binding. Library, KDC, various facilities.

    Post summary

    The passage lists two newly disclosed Apache Kerby CVEs with brief technical descriptions and links to security mailing list discussions, indicating the announcement of new vulnerabilities.

    010511.0K
    4.7K followersView on X
  • Can Artuc@canartuc
    Disclosure

    Apache Kerby, the Java Kerberos library, has an auth-bypass flaw: CVE-2026-57915 lets an attacker skip pre-authentication by sending PA-DATA with an unrecognized or unsupported type. Rated important, fixed in 2.1.2. How many Kerberos stacks quietly accept unknown PA-DATA types?

    Post summary

    The post discloses CVE-2026-57915 in Apache Kerby, explaining how an attacker can bypass pre‑authentication by sending unsupported PA‑DATA and notes that the flaw is fixed in release 2.1.2.

    0000044
    173 followersView on X

Explore more

Back to dashboard