# Windows Kerberos PAC validation in cross-forest scenarios

Source: https://startwithidentity.com/cves/cve-2024-29056/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

CVE-2024-29056 is the cross-forest variant of [CVE-2024-26248](https://startwithidentity.com/cves/cve-2024-26248/). PAC validation added after CVE-2022-37967 did not hold across a forest trust the way it held inside a forest. April 2024. Same staged-enforcement model.

## Why it matters

Forest trusts are how M&A and resource forests still work. A PAC bypass across a trust is "we thought the resource forest was isolated." Identity architects who designed a red-forest or a resource forest around PAC integrity need this ID in the same change as 26248.

## What to do

- Patch both sides of every trust. A patched account forest and an unpatched resource forest is not a mitigation.
- After enforcement, test TGS across the trust before you close the change.
- Review SID filtering and selective authentication. PAC bugs are how trust assumptions die.

## After you patch

Active Directory compromise is not contained by patching, because the artifacts an attacker creates outlive the vulnerability.

- **Rotate the krbtgt account twice**, with the replication interval between rotations, if there is any indication of ticket forgery. One rotation is not enough.
- **Audit AD CS certificate templates** for enrolment and enrollee-supplied-subject permissions, which are the most common escalation path left behind. See [certificate lifecycle](https://startwithidentity.com/glossary/certificate-lifecycle/).
- **Review privileged group membership and delegation rights** (Domain Admins, DnsAdmins, constrained and resource-based constrained delegation) for changes during the window.
- **Hunt for tickets with anomalous lifetimes or encryption types**, and for authentications to services that identity never touches.
- **Treat any issued certificate as a durable credential**: revoking a user's password does not revoke a certificate that authenticates as them. See [privilege escalation](https://startwithidentity.com/glossary/privilege-escalation/) and [lateral movement](https://startwithidentity.com/glossary/lateral-movement/).

## Sources

- [NVD: CVE-2024-29056](https://nvd.nist.gov/vuln/detail/CVE-2024-29056)
- Microsoft PAC-validation servicing guidance, April 2024