Identity CVE · Kerberos / Active Directory
CVE-2024-29056Windows Kerberos PAC validation in cross-forest scenarios
high
What broke
CVE-2024-29056 is the cross-forest variant of CVE-2024-26248. PAC validation added after CVE-2022-37967 did not hold across a forest trust the way it held inside a forest. April 2024. Same staged-enforcement model.
Why it matters
Forest trusts are how M&A and resource forests still work. A PAC bypass across a trust is "we thought the resource forest was isolated." Identity architects who designed a red-forest or a resource forest around PAC integrity need this ID in the same change as 26248.
What to do
- Patch both sides of every trust. A patched account forest and an unpatched resource forest is not a mitigation.
- After enforcement, test TGS across the trust before you close the change.
- Review SID filtering and selective authentication. PAC bugs are how trust assumptions die.
Sources
- NVD: CVE-2024-29056
- Microsoft PAC-validation servicing guidance, April 2024
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.