Immediate Action: Enforce PAC Validation for CVE-2024-26248 & CVE-2024-29056
Last year, Windows updates released on and after April 9, 2024 added new behaviors that start the process of addressing a security risk in the Kerberos PAC Validation Protocol. Starting today, the Enforcement phase of deployment begins. After installing the April 2025 Windows security update and later updates on all Windows domain controllers and Windows clients, support for Compatibility mode will be removed, and the new secure behavior will be enabled by default. This will properly mitigate the vulnerabilities described in CVE-2024-26248 and CVE-2024-29056. When will this happen? The Enforcement phase starts today with the release of the April 2025 Windows security update. How will this affect your organization? To mitigate the risks described in CVE-2024-26248 and CVE-2024-29056, you must update your entire Windows environment. This must include all Windows domain controllers and Windows clients. Environments that are not up to date will not recognize the new request structure and security checks will fail. What do you need to do to prepare? Additional information: Install the April 2025 Windows security update on all Windows domain controllers and Windows clients. Enforcement mode will be fully enabled in your environment. This will properly mitigate the vulnerabilities described in CVE-2024-26248 and CVE-2024-29056. KB5037754: How to manage PAC Validation changes related to CVE-2024-26248 and CVE-2024-29056 KB5020805: How to manage Kerberos protocol changes related to CVE-2022-37967 Message ID: MC1050817
The post Immediate Action: Enforce PAC Validation for CVE-2024-26248 & CVE-2024-29056 appeared first on M365 Admin.
Published on:
Learn moreWe can help you with Immediate Action: Enforce PAC Validation for CVE-2024-26248 & CVE-2024-29056
If you want help implementing, troubleshooting, or improving this product, contact us and we’ll point you in the right direction.
Related posts
Change in sender email address for Copilot emails
Microsoft is updating the sender email for Copilot-related educational and enablement emails to [email protected] by mid-S...
Microsoft Purview: Information Protection – Auto-labeling simulation scale increase from 4 million to 20 million items
Microsoft Purview Information Protection increases auto-labeling simulation capacity from 4 million to 20 million items, expands SharePoint si...
Microsoft Exchange Online: Review and configure EWSAllowedAppIDs before Exchange Web Services access changes
Microsoft is updating how EWSAllowedAppIDs is applied in Exchange Online as part of EWS retirement starting October 1, 2026. Organizations usi...
IT resources to plan, prepare, and deploy Windows
New and updated resources are available whether you’re a seasoned IT pro or earlier in your career. Learn how to effectively roll out feature ...
[Whiteboard] Legacy Whiteboard migration to OneDrive
Microsoft Whiteboard is migrating from legacy Azure-based storage to OneDrive-backed storage. Migration must be completed by September 25, 202...
Microsoft Teams: Organize important resources in chats and channels
Microsoft Teams is introducing a new way to organize and access important resources in chats and channels. Users will be able to pin key conte...
Microsoft Teams: Analytics for desk utilization on Teams Pro Management portal
Teams admins can access utilization analytics for Teams bookable desks on Teams Pro Management portal, similar to analytics provided for meeti...
Outlook: Inline chat for email drafting
Instead of opening Copilot Chat every time you want to use Copilot to draft a message, this change introduces an inline chat component that st...
SharePoint: Changes to the FAQ web part authoring experience
The SharePoint FAQ web part will provide a standard, non-AI experience for manually creating, editing, and managing FAQs. The AI-assisted FAQ ...
Microsoft Teams: Multi-line call history tabs in the Calls app
Multi-line users get a redesigned call history experience that organizes activity by phone line. Call activity is organized into dedicated tab...