CVE-2026-40355 MIT CVE debrief

Who should care

Users of MIT Kerberos 5, particularly those who have applications that use the gss_accept_sec_context() function, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating /etc/gss/mech, monitoring for potential attacks, and applying patches as soon as possible. IT administrators and security teams responsible for systems using MIT Kerberos 5 should prioritize this vulnerability based on its MEDIUM severity and potential impact on their systems.

Technical summary

The vulnerability is caused by a NULL pointer dereference in the gss_accept_sec_context() function of MIT Kerberos 5. This function is used to accept a security context, and in certain cases, it can lead to a NULL pointer dereference. An unauthenticated remote attacker can trigger this vulnerability, causing the process to terminate. The vulnerability exists when a NegoEx mechanism is registered in /etc/gss/mech. Affected users should apply patches and review /etc/gss/mech to ensure only necessary mechanisms are registered.

Defensive priority

Medium

Recommended defensive actions

• Apply the patch from the MIT Kerberos 5 repository
• Review and update /etc/gss/mech to ensure that only necessary mechanisms are registered
• Monitor for and respond to potential attacks on the gss_accept_sec_context() function
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-28T06:16:03.663Z and was last modified on 2026-07-08T12:48:28.803Z. The NVD entry is currently Analyzed. This vulnerability affects MIT Kerberos 5, specifically versions before 1.22.3. The vulnerability exists in the gss_accept_sec_context() function when a NegoEx mechanism is registered in /etc/gss/mech. Evidence of exploitation is limited, but defenders should verify system logs for potential attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.