CVE-2026-69676: Kerberos Authentication Bypass by Capture-Replay

Kerberos is the authentication backbone of Active Directory, and its design assumes captured credentials cannot simply be replayed. CVE-2026-69676 is a bypass of that assumption, and it is a reminder that the protocol's protections depend on implementation details.

What the record says

NVD describes CVE-2026-69676 as authentication bypass by capture-replay in Windows Kerberos allowing an authorized attacker to execute code over a network. The weakness is CWE-294, authentication bypass by capture-replay, and the CVSS base score is 8.8. It was published on 8 September 2026, with Microsoft's update guide as the vendor reference.

Why replay protections exist and what breaks them

Kerberos uses timestamps and nonces precisely so that a captured ticket or authentication exchange cannot be reused. If an implementation fails to verify freshness or uniqueness in the way the protocol intends, the authentication material an attacker can observe on the network becomes reusable.
The "authorized attacker" qualifier in the description matters. This is not an unauthenticated entrance; it is a flaw that helps somebody who can already see traffic or who holds some level of access. In Active Directory environments, that describes a wide range of realistic positions: a compromised workstation on the same segment, a service account with excessive access, or an attacker who has obtained a foothold in a less sensitive part of the network.

The blast radius sits in the domain

Once replay works, the value of captured authentication material changes. Material that would normally be worthless after the session ends can instead be reused to reach services the original account could reach. In an environment where privileged accounts exist and service accounts hold standing rights, that is a path toward domain-level access even though the CVE is scoped to a single component.
Two consequences follow.
First, network position stops being a minor factor. Segments where a compromised host can observe authentication traffic are the segments where this flaw converts into lateral movement.
Second, the patch does not clean up. Authentication material captured before the fix remains usable if the weakness allowed persistence; rotating privileged account credentials after patching is the conservative step.

Handling

Apply the September 2026 Windows updates to domain controllers and member servers, and confirm the domain controllers were actually restarted into the new build. A Kerberos fix on a domain controller that has not been rebooted is a common gap.
Then reduce how much authentication material is exposed. Enable SMB signing and LDAP signing and channel binding, remove legacy protocols that carry credentials in weak or absent protection, and treat the Kerberos ARMOR or FAST settings as something to evaluate rather than assume.
Audit service accounts for standing privileges, and alert on ticket anomalies: a service ticket request pattern that does not match the normal behaviour of that account is the observable side of a replay that succeeded.

References

• NVD record for CVE-2026-69676: https://nvd.nist.gov/vuln/detail/CVE-2026-69676
• Microsoft update guide entry: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69676
• Microsoft September 2026 release notes: https://msrc.microsoft.com/update-guide/releaseNote/2026-Sep