cve 2026 20833

Microsoft’s July 14, 2026 cumulative updates will permanently remove Windows domain controllers’ Kerberos RC4 rollback control, while administrators must separately verify that Microsoft Malware Protection Engine version 1.1.26060.3008 or later reached every Defender endpoint. A third deadline...

Microsoft has recorded CVE‑2026‑20833 as an information‑disclosure vulnerability affecting Windows’ Kerberos authentication stack, and while the vendor acknowledgement makes the defect real and actionable, the public record is intentionally terse — leaving defenders with firm guidance to patch...