CVE-2011-0040
The server in Microsoft Active Directory on Windows Server 2003 SP2 does not properly handle an...
The server in Microsoft Active Directory on Windows Server 2003 SP2 does not properly handle an update request for a service principal name (SPN), which allows remote attackers to cause a denial of service (authentication downgrade or outage) via a crafted request that triggers name collisions, aka "Active Directory SPN Validation Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
The server in Microsoft Active Directory on Windows Server 2003 SP2 does not properly handle an update request for a service principal name (SPN), which allows remote attackers to cause a denial of service (authentication downgrade or outage) via a crafted request that triggers name collisions, aka "Active Directory SPN Validation Vulnerability."
- Record
CVE-2011-0040- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The server in Microsoft Active Directory on Windows Server 2003 SP2 does not properly handle an update request for a service principal name (SPN), which allows remote attackers to cause a denial of service (authentication downgrade or outage) via a crafted request that triggers name collisions, aka "Active Directory SPN Validation Vulnerability."
- Record
CVE-2011-0040- Updated
- 2026-11-02
EUVDEUVD-2011-0066 No score
The server in Microsoft Active Directory on Windows Server 2003 SP2 does not properly handle an update request for a service principal name (SPN), which allows remote attackers to cause a denial of service (authentication downgrade or outage) via a crafted request that triggers name collisions, aka "Active Directory SPN Validation Vulnerability."
- Record
EUVD-2011-0066- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9w6c-58mr-5mwx No score
The server in Microsoft Active Directory on Windows Server 2003 SP2 does not properly handle an...
The server in Microsoft Active Directory on Windows Server 2003 SP2 does not properly handle an update request for a service principal name (SPN), which allows remote attackers to cause a denial of service (authentication downgrade or outage) via a crafted request that triggers name collisions, aka "Active Directory SPN Validation Vulnerability."
- Record
GHSA-9w6c-58mr-5mwx- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-0040 is a medium vulnerability (CVSS 5.0) in Microsoft Windows 2003 Server, published February 9, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 22.8%, the 97th percentile. No source names a fixed version.