Identity CVE · Kerberos / Active Directory
CVE-2025-33073Windows SMB Kerberos reflection elevation of privilege
high
What broke
Windows allowed a Kerberos authentication reflection against SMB: a service could bounce a ticket back at itself and escalate. Microsoft patched the first path. Researchers then showed Ghost SPNs (SPNs that linger after a name change or DNS self-registration) still made the pattern work. CVE-2025-58726 is the October 2025 follow-on.
Why it matters
Reflection plus a stale SPN is how "we patched Kerberos" still becomes domain admin. Machine identity in AD is messy: DNS updates, SPN writes, and computer accounts that outlive their names.
What to do
- Deploy both the original fix and the October 2025 SMB/Kerberos update.
- Audit Ghost SPNs. A computer account with an SPN that no longer matches DNS is a finding, not a curiosity.
- Restrict who can write SPNs and who can register DNS names in the AD-integrated zone.
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.