If a Linux Kerberos realm backs customer services, check where clients can reach its KDC and administration endpoints. Authentication can fail across dependent services if those components become unavailable.
MIT published MITKRB5-SA-2026-001 on November 9. MSRC added Azure Linux 3.0 krb5 1.21.3-6 at 01:08 UTC November 13 for CVE-2026-112314, CVE-2026-112320, CVE-2026-112321, CVE-2026-112322, CVE-2026-112323 and CVE-2026-119079. MSRC rates all six CVSS 3.1 7.5. It rates CVE-2026-112320 and CVE-2026-112321 Important and the others Moderate. The affected paths include kadmind, the KDC and a GSS-RPC client path. Check the role each installed host actually performs.
MIT identifies upstream 1.22.3 as fixed. MSRC does not list a fixed Azure Linux build or a complete affected range for these rows. The Microsoft production x86-64 package index still lists 1.21.3-6. The reviewed official sources do not confirm exploitation, and these six CVEs are absent from KEV.
Suggested MSP priority. Expedite realms with reachable KDC or administration services and customer authentication dependencies. Limit administrative reachability to required hosts, preserve client access needed by the realm, and monitor for unexpected restarts or resource exhaustion. Apply the signed fix supported by the distribution once verified, or use MIT’s fixed release where your deployment supports it. Verify the service package and exercise ticket issuance and administration after rollout.
Last verified November 13, 2026 UTC. MSRC November CVRF · MIT Kerberos advisory · Azure Linux x86-64 packages · CISA KEV.