CVE-2026-20833: 
vulnerability analysis and mitigation

CVE-2026-20833 is an information disclosure vulnerability caused by the use of a broken or risky cryptographic algorithm (RC4) in Windows Kerberos. It was disclosed by Microsoft on January 13, 2026, as part of the January 2026 Patch Tuesday security updates. The vulnerability affects a wide range of Windows Server versions, from Windows Server 2008 SP2 through Windows Server 2025. It carries a CVSS v3.1 base score of 5.5 (Medium), assigned by Microsoft (Microsoft MSRC, Feedly).

The root cause is classified as CWE-327 (Use of a Broken or Risky Cryptographic Algorithm), specifically the continued support for RC4 encryption within the Windows Kerberos Key Distribution Center (KDC) for service account ticket issuance. RC4 is a cryptographically weak stream cipher susceptible to cryptanalysis and brute-force attacks, enabling an attacker with local access and low privileges to recover authentication credentials or sensitive Kerberos ticket material. The attack vector is local, requires low privileges, and no user interaction, making it exploitable by any authenticated user on an affected system. Microsoft's January 2026 update introduced the first phase of RC4 hardening — logging and detection of RC4 usage — with subsequent phases planned to enforce stronger encryption (Microsoft MSRC, Microsoft TechCommunity RC4 Blog, Microsoft KDC RC4 Guide).

A low-privileged local attacker with valid credentials can exploit weak RC4 cryptographic implementations in Windows Kerberos to extract authentication credentials and sensitive Kerberos ticket information. This could facilitate Kerberoasting-style attacks — where service ticket hashes are cracked offline — enabling lateral movement across enterprise Active Directory environments and potential privilege escalation. The vulnerability has no impact on availability or integrity; the impact is limited to confidentiality (High). Affected products span Windows Server 2008 SP2/R2 SP1 through Windows Server 2025, covering a broad range of enterprise deployments (Feedly, 4sysops RC4 Kerberoasting).

1. Reconnaissance: Identify a Windows Server domain controller running an unpatched version (e.g., Windows Server 2019 before 10.0.17763.8276) using tools like BloodHound or ldapsearch to enumerate Active Directory service accounts with SPNs (Service Principal Names).
2. Request RC4-encrypted Kerberos service tickets: Using a tool such as Rubeus or Impacket's GetUserSPNs.py, request Kerberos TGS (Ticket Granting Service) tickets for identified service accounts, specifying RC4 (ARCFOUR-HMAC-MD5) as the encryption type.
3. Extract ticket hashes: Capture the RC4-encrypted TGS ticket hashes from the Kerberos response. These hashes are derived from the service account's NTLM password hash.
4. Offline cracking: Use a password cracking tool such as Hashcat or John the Ripper with the -m 13100 (Kerberoast) mode to perform offline dictionary or brute-force attacks against the weak RC4 ticket hashes.
5. Credential disclosure: Successfully cracked hashes reveal the plaintext password of the service account, enabling the attacker to authenticate as that account and potentially move laterally or escalate privileges within the domain (4sysops RC4 Kerberoasting, Microsoft KDC RC4 Guide).

• Logs: Windows Event ID 4769 (Kerberos Service Ticket Request) with Ticket Encryption Type 0x17 (RC4-HMAC) logged on domain controllers — the January 2026 update introduces new audit events specifically to surface RC4 usage; review Security event logs for unusual volumes of RC4 TGS requests from a single account or host.
• Logs: New event IDs introduced by Microsoft's RC4 hardening update to flag KDC issuance of RC4-encrypted tickets for service accounts; monitor for these events in the System or Security event log on domain controllers.
• Network: Kerberos TGS-REQ packets with etype field set to 17 (RC4-HMAC) or 23 (RC4-HMAC-EXP) in network captures, particularly in bulk from a single source IP.
• Process: Execution of known Kerberoasting tools such as Rubeus.exe, GetUserSPNs.py, or Invoke-Kerberoast.ps1 on domain-joined hosts; unusual PowerShell or Python processes making LDAP queries for servicePrincipalName attributes.
• File System: Presence of Rubeus, Impacket, or similar offensive tooling binaries in temporary or user-writable directories on domain-joined systems (Microsoft KDC RC4 Guide, 4sysops RC4 Kerberoasting).

Microsoft released security updates on January 13, 2026 addressing this vulnerability across all affected Windows Server versions. The patched builds are: Windows Server 2008 SP2 (6.0.6003.23717), Windows Server 2008 R2 SP1 (6.1.7601.28117), Windows Server 2012 (6.2.9200.25868), Windows Server 2012 R2 (6.3.9600.22968), Windows Server 2016 (10.0.14393.8783), Windows Server 2019 (10.0.17763.8276), Windows Server 2022 (10.0.20348.4648), Windows Server 2022 23H2 (10.0.25398.2092), and Windows Server 2025 (10.0.26100.32230). A second hardening phase began with the April 2026 security updates, which further restricts RC4 usage. Administrators should apply the January 2026 (and subsequent April 2026) patches, audit RC4 usage via the new event logging introduced by the update, configure service accounts to use AES encryption (set msDS-SupportedEncryptionTypes to exclude RC4), and implement network segmentation to limit lateral movement if credentials are compromised (Microsoft MSRC, Microsoft KDC RC4 Guide, RC4 Hardening Guide).

Microsoft published multiple TechCommunity blog posts explaining the RC4 deprecation roadmap, including detailed guidance on what changed in the January 2026 update and how to manage the transition (Microsoft TechCommunity RC4 Blog, RC4 Hardening Guide). The April 2026 Phase 2 update caused Windows Server domain controllers to enter reboot loops in some environments, generating significant community discussion on Reddit and coverage from outlets including BleepingComputer and CyberSecurityNews (BleepingComputer Jan 2026, CyberSecurityNews Reboot). Security practitioners on Reddit's r/activedirectory and r/sysadmin communities raised concerns about compatibility impacts on services relying on RC4, including FSLogix, Azure Files, SharePoint, and NetApp ONTAP (Reddit AD RC4, Microsoft FSLogix Advisory). The Zero Day Initiative and Sophos also covered the vulnerability as part of their January 2026 Patch Tuesday reviews (ZDI Jan 2026, Sophos Jan 2026).