{"id":"CVE-2020-16996","state":"PUBLISHED","title":"Kerberos Security Feature Bypass Vulnerability","description":"Kerberos Security Feature Bypass Vulnerability","publishedAt":"2020-12-09T23:36:38.000Z","updatedAt":"2026-06-09T18:08:06.518Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft Windows Server 2012","Microsoft Windows Server 2012 (Server Core installation)","Microsoft Windows Server 2012 R2","Microsoft Windows Server 2012 R2 (Server Core installation)","Microsoft Windows Server 2016","Microsoft Windows Server 2016 (Server Core installation)","Microsoft Windows Server 2019","Microsoft Windows Server 2019 (Server Core installation)","Microsoft Windows Server version 2004","Microsoft Windows Server version 20H2","Microsoft Windows Server, version 1903 (Server Core installation)","Microsoft Windows Server, version 1909 (Server Core installation)"],"affected":[{"vendor":"Microsoft","product":"Windows Server 2012","versions":[{"version":"6.2.9200.0","status":"affected","lessThan":"6.2.9200.23298","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server 2012 (Server Core installation)","versions":[{"version":"6.2.9200.0","status":"affected","lessThan":"6.2.9200.23298","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server 2012 R2","versions":[{"version":"6.3.9600.0","status":"affected","lessThan":"6.3.9600.19968","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server 2012 R2 (Server Core installation)","versions":[{"version":"6.3.9600.0","status":"affected","lessThan":"6.3.9600.19968","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server 2016","versions":[{"version":"10.0.14393.0","status":"affected","lessThan":"10.0.14393.4283","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server 2016 (Server Core installation)","versions":[{"version":"10.0.14393.0","status":"affected","lessThan":"10.0.14393.4283","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server 2019","versions":[{"version":"10.0.17763.0","status":"affected","lessThan":"10.0.17763.1817","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server 2019 (Server Core installation)","versions":[{"version":"10.0.17763.0","status":"affected","lessThan":"10.0.17763.1817","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server version 2004","versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.19043.867","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server version 20H2","versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.19043.867","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server, version 1903 (Server Core installation)","versions":[{"version":"10.0.0","status":"affected","lessThan":"publication","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server, version 1909 (Server Core installation)","versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.18363.1440","versionType":"custom"}],"platforms":["x64-based Systems"]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-16996","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16996"],"weaknesses":[],"ingestedAt":"2026-10-29T19:46:39.756Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/16xxx/CVE-2020-16996.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2020-16996","state":"PUBLISHED","datePublished":"2020-12-09T23:36:38.000Z","dateUpdated":"2026-06-09T18:08:06.518Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2020-08-04T00:00:00.000Z"},"containers":{"cna":{"title":"Kerberos Security Feature Bypass Vulnerability","descriptions":[{"lang":"en-US","value":"Kerberos Security Feature Bypass Vulnerability"}],"affected":[{"vendor":"Microsoft","product":"Windows Server 2012","versions":[{"version":"6.2.9200.0","status":"affected","lessThan":"6.2.9200.23298","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server 2012 (Server Core installation)","versions":[{"version":"6.2.9200.0","status":"affected","lessThan":"6.2.9200.23298","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server 2012 R2","versions":[{"version":"6.3.9600.0","status":"affected","lessThan":"6.3.9600.19968","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server 2012 R2 (Server Core installation)","versions":[{"version":"6.3.9600.0","status":"affected","lessThan":"6.3.9600.19968","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server 2016","versions":[{"version":"10.0.14393.0","status":"affected","lessThan":"10.0.14393.4283","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server 2016 (Server Core installation)","versions":[{"version":"10.0.14393.0","status":"affected","lessThan":"10.0.14393.4283","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server 2019","versions":[{"version":"10.0.17763.0","status":"affected","lessThan":"10.0.17763.1817","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server 2019 (Server Core installation)","versions":[{"version":"10.0.17763.0","status":"affected","lessThan":"10.0.17763.1817","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server version 2004","versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.19043.867","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server version 20H2","versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.19043.867","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server, version 1903 (Server Core installation)","versions":[{"version":"10.0.0","status":"affected","lessThan":"publication","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows Server, version 1909 (Server Core installation)","versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.18363.1440","versionType":"custom"}],"platforms":["x64-based Systems"]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-16996","name":"Kerberos Security Feature Bypass Vulnerability","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"MEDIUM","baseScore":6.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"description":"Security Feature Bypass","lang":"en-US","type":"Impact"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2026-06-09T18:08:06.518Z"},"datePublic":"2020-12-08T08:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.17763.0","versionEndExcluding":"10.0.17763.1817"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.17763.0","versionEndExcluding":"10.0.17763.1817"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_1909:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.0.18363.1440"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_1903:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"publication"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.0.19043.867"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.14393.0","versionEndExcluding":"10.0.14393.4283"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.14393.0","versionEndExcluding":"10.0.14393.4283"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*","versionStartIncluding":"6.2.9200.0","versionEndExcluding":"6.2.9200.23298"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*","versionStartIncluding":"6.2.9200.0","versionEndExcluding":"6.2.9200.23298"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*","versionStartIncluding":"6.3.9600.0","versionEndExcluding":"6.3.9600.19968"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*","versionStartIncluding":"6.3.9600.0","versionEndExcluding":"6.3.9600.19968"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_20H2:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.0.19043.867"}]}]}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16996","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T13:45:34.839Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-02-27T16:58:51.407209Z","id":"CVE-2020-16996","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-01T15:56:13.954Z"}}]}}}