Start with Identity
Subscribe
Identity CVE · Kerberos / Active Directory

CVE-2025-26647Windows Kerberos PKINIT / NTAuth certificate logon bypass

high
Product: Windows Kerberos KDCVendor: MicrosoftCWE-20Disclosed: 2025-04-08Status: PatchedNVD ↗

What broke

The Windows Kerberos KDC accepted certificate-based logon (PKINIT) without the NTAuth store checks operators believed were in force. A crafted or mis-issued certificate becomes a domain logon. Microsoft patched this in April 2025 and tightened NTAuth enforcement. Getting the enforcement mode right is part of the fix, not an optional hardening note.

Why it matters

Certificate logon is how smart cards, Windows Hello for Business, and a lot of AD CS abuse become a TGT. Combined with CVE-2024-49019 (ESC15 / EKUwu) and the still-exploited Certifried mapping gap, 2025 was the year certificate authentication stopped being the "safe" Kerberos path.

What to do

  • Deploy the April 2025 Kerberos updates on every DC.
  • Audit the NTAuth store. Only your intended enterprise CAs belong there.
  • Turn on strong certificate mapping (KB5014754) if it is not already in enforcement. CVE-2022-26923 is still showing up in incident response.
  • Review AD CS templates for ESC1-ESC16, not only this CVE.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.