Start with Identity
Subscribe
Identity CVE · Kerberos / Active Directory

CVE-2026-25177KerberLoss, invisible-Unicode SPN uniqueness bypass

high · CVSS 8.8
Product: Active Directory (Kerberos SPNs)Vendor: MicrosoftDisclosed: 2026-03-10Status: PatchedNVD ↗

What broke

Active Directory's SPN uniqueness check did not treat invisible-Unicode look-alikes as collisions. An attacker who can write an SPN registers a twin of HTTP/app.contoso.com, intercepts Kerberos traffic, and can downgrade the client to NTLM. Semperis and Shai Laron named it KerberLoss. CVSS 8.8. Microsoft patched in March 2026.

Why it matters

SPN uniqueness is the only thing standing between "I can write a servicePrincipalName" and "I am the app." Combined with Ghost SPNs and ResetNightmare, 2026 made AD's name-uniqueness story look as fragile as SAML's signature-binding story.

What to do

  • Deploy the March 2026 AD / Kerberos updates on every DC.
  • Alert on new SPNs that contain non-ASCII characters. There is almost never a business reason.
  • Restrict Validated write to service principal name to the smallest set of computer accounts that need it.
  • Semperis published detection guidance. Use it even after you patch.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.