KerberLoss: invisible Unicode lets an attacker twin a Kerberos SPN

CVE-2026-25177 is the Active Directory SPN uniqueness bypass Semperis and Shai Laron named KerberLoss. AD did not treat invisible-Unicode look-alikes as collisions, so an attacker who can write an SPN registers a twin of HTTP/app.contoso.com, intercepts Kerberos traffic, and can downgrade the client to NTLM. CVSS 8.8. Microsoft patched it in March 2026.

This sits next to the 2025 Ghost SPN / SMB reflection work. SPNs are identity, not inventory trivia. We filed the brief under Kerberos / Active Directory with a concrete hunt: new SPNs that contain non-ASCII characters. There is almost never a business reason.

Why it matters

SPN uniqueness is the only thing standing between "I can write a servicePrincipalName" and "I am the app." If your delegation graph or DNS self-registration is messy, this CVE is how that mess becomes a ticket.

If you have not confirmed the March 2026 AD updates on every DC, do that, then restrict validated write to servicePrincipalName. The KerberLoss brief has the detection notes.

Source: NVD: CVE-2026-25177