CVE-2014-6324: Microsoft Windows Kerberos KDC privilege escalation via forged ticket signature

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityA remote authenticated domain user can escalate to domain administrator, the flaw is in CISA KEV with confirmed in-the-wild exploitation and very high EPSS, and it affects core Active Directory infrastructure.

What it is

The Kerberos Key Distribution Center (KDC) in multiple Windows client and server versions fails to properly validate the signature (checksum) in a ticket, allowing a remote authenticated domain user to forge a ticket that grants domain administrator privileges. Because any valid low-privileged domain account can be used, this is a direct path from ordinary user to full domain compromise.

Impact

An attacker with a valid domain user account can obtain domain administrator privileges, gaining full control over the Active Directory domain, including all users, systems and data.

Attack surface

Reachable over the network against the KDC; the attacker must be an authenticated domain user (PR:L) and no user interaction is required (UI:N). No local access or special position is needed beyond domain membership.

Exploitation

CVE-2014-6324 is listed in CISA KEV (added 2022-03-25) and the description states it was exploited in the wild in November 2014; EPSS 30-day probability is 0.87448 (99.7th percentile), indicating very high likelihood of exploitation activity.

What to do

• Apply the Microsoft MS14-068 security update to all affected Windows versions (Server 2003 SP2, Vista SP2, Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Server 2012 Gold/R2).
• Prioritize patching of domain controllers, since the KDC role is the vulnerable component.
• Audit and reduce the number of accounts with domain user rights that can reach the KDC, and enforce least privilege.
• Monitor for and investigate anomalous Kerberos ticket requests and privilege changes on domain controllers.
• Where legacy systems cannot be patched, isolate them and restrict network access to the KDC.

Detection

• Monitor domain controller event logs for Kerberos ticket-granting and service ticket anomalies, especially unexpected privilege attributes in tickets.
• Alert on creation of new domain administrator accounts or elevation events from ordinary user accounts.
• Correlate Kerberos authentication events with subsequent privileged actions on domain controllers.
• Use the Microsoft SRD blog and US-CERT TA14-323A guidance to build specific detection signatures for forged ticket signatures.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.