cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

CVE-2026-25177: Active Directory Flaw Can Enable Privilege Escalation Through SPN Abuse

· Original article ↗

Summary

The article describes CVE-2026-25177 as a high-severity Active Directory flaw that can enable privilege escalation through SPN manipulation and Kerberos abuse, and recommends patching alongside least-privilege controls and service-account governance.

Key points

  • The article describes CVE-2026-25177 as a high-severity privilege-escalation flaw in Microsoft Active Directory Domain Services, rated CVSS 8.8.
  • It says an authenticated user with permission to modify Service Principal Names (SPNs) could create a duplicate SPN and interfere with Kerberos authentication.
  • The article says this may cause denial of service or force fallback to NTLM; it states the attacker does not need access to the targeted server beyond the initial SPN-write permission.
  • It recommends promptly patching domain controllers and says patching alone does not address excessive permissions or configuration drift.
  • Recommended measures include least-privilege delegation, regular service-account and group audits, monitoring unusual SPN and Kerberos activity, and disabling NTLM where possible.
  • The article promotes One Identity Active Roles for access governance and presents its claimed controls as a way to manage AD permissions and identities.

Article Details

Vulnerability Types
  • Privilege escalation
  • Kerberos authentication disruption
Severity
High (CVSS 8.8)
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Disable NTLM wherever possible.

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationThe article describes exploiting CVE-2026-25177 to escalate privileges from an authenticated domain user.T1078 · Valid AccountsThe described attack requires an authenticated domain user with permission to modify Service Principal Names.

CVE

CVE-2026-25177Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +19 moreCVE-2026-25177 is a high-severity privilege escalation flaw in Microsoft Active Directory Domain Services that can let an authenticated domain user gain broader access through SPN manipulation and Kerberos abuse.

Vendors

MicrosoftCVE-2026-25177 is a high-severity privilege escalation flaw in Microsoft Active Directory Domain Services that can let an authenticated domain user gain broader access through SPN manipulation and Kerberos abuse.One IdentityThat’s the gap One Identity Active Roles steps into.

Products

Active Directory Domain ServicesCVE-2026-25177 is a high-severity privilege escalation flaw in Microsoft Active Directory Domain Services that can let an authenticated domain user gain broader access through SPN manipulation and Kerberos abuse.Active RolesLeast-privilege delegation, consistent policy enforcement, and governance tools like Active Roles reduce exposure.Entra IDUnified visibility across on-premises AD, Entra ID, and Microsoft 365 with security policies applied consistently rather than managed domain by domain is a foundational requirement, not a luxury.Microsoft 365 Apps for EnterpriseCVE-2026-25177 also exposes a challenge familiar to teams managing large environments: policy enforcement across multiple AD domains and Microsoft 365 tenants is rarely as consistent as intended.Microsoft Active DirectoryCVE-2026-25177 is a high-severity privilege escalation flaw in Microsoft Active Directory Domain Services that can let an authenticated domain user gain broader access through SPN manipulation and Kerberos abuse.

Related Articles