Microsoft officially deprecated the RC4 encryption algorithm, ending its 26 years of use within Windows systems. This action addresses a significant, long-known security vulnerability inherent in the legacy cryptographic cipher.
For years, Windows servers maintained default support for RC4-based authentication requests as a fallback mechanism. Attackers frequently exploited this weakness through methods such as Kerberoasting attacks.
The deprecation follows considerable criticism and high-profile security incidents where the vulnerability proved a key factor. RC4 use was notably implicated in the major breach of Ascension health, which caused severe disruptions across 140 hospitals.
By removing the outdated algorithm, Microsoft takes a significant step to improve enterprise network security. The move addresses systemic risks that persisted for over two decades. No significant market reaction was noted following the announcement.