CVE-2026-11861: Freeipa Kdcpolicy Unverified Pac Tgscve-2026-11861-freeipa-kdcpolicy-unverified-pac-tgs
KDC policy check for TGS requests enforces PAC presence without parsing and validating PAC content. In cross-realm Kerberos trust relationships, failing to validate PAC content allows client principal impersonation.