This vulnerability involves a security flaw in Windows Kerberos on Windows 10 Version 1607 (build 10.0.14393.0) where the system improperly relies on untrusted inputs when making security decisions. This weakness can be exploited by an authorized attacker over a network to elevate their privileges. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix to address this issue.

An authorized attacker who can access the network may exploit this vulnerability to elevate their privileges on the affected system. This can lead to full compromise of confidentiality, integrity, and availability of the system. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 10 Version 1607 (build 10.0.14393.0) as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20849 to remediate this vulnerability.