Start with Identity
Subscribe
Identity CVE · Kerberos / Active Directory

CVE-2025-60704CheckSum, Kerberos S4U missing cryptographic step

critical
Product: Windows Kerberos KDC (S4U)Vendor: MicrosoftCWE-325Disclosed: 2025-11-11Status: PatchedNVD ↗

What broke

Windows Kerberos skipped a required cryptographic step when processing PA-S4U-X509-USER (CWE-325, missing cryptographic step). An attacker can forge the identity used in S4U2self and obtain tickets as another user, up to domain compromise. Silverfort branded the research "CheckSum." It was presented at Black Hat Europe in December 2025. Microsoft shipped a KDC patch.

Why it matters

S4U is how services impersonate users in constrained delegation. A missing checksum on that path is not a local bug. It is a protocol-level identity forge inside Active Directory. If you run unconstrained or resource-based constrained delegation, assume this CVE is in your threat model even after the patch, and go look at the delegation graph.

What to do

  • Patch every DC. KDC bugs are not workstation tickets.
  • Inventory S4U / constrained-delegation use. Remove it where a modern alternative (Kerberos-only, Entra ID app proxy, or a resource-based grant) will do.
  • Silverfort and Semperis both publish detection guidance for this class. Use it.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.