Kerberos and Active Directory identity CVEs
PAC validation, PKINIT, S4U, SPN uniqueness, and kpasswd. 2024-2026 made AD's name and ticket story look as fragile as SAML's signature story.
How this protocol fails
A KDC bug is domain identity, not a workstation ticket. The train runs from Kerberos server impersonation and PAC spoofing (2024), through PKINIT/NTAuth and CheckSum S4U (2025), to KerberLoss invisible-Unicode SPNs and ResetNightmare kpasswd (2026). AD CS (Certifried, ESC15) is how a wrong certificate becomes a TGT. Ghost SPNs and DNS self-registration keep reflection alive after the first patch. If you only patch "the CVE on the Patch Tuesday slide" and skip enforcement mode, you are not done.
What security people should do
- Treat DC Kerberos updates as one train. April 2024 PAC, April 2025 PKINIT, and the 2026 SPN/kpasswd fixes all belong on every DC.
- Turn on strong certificate mapping (KB5014754) in enforcement, not compatibility. Audit NTAuth. Review ESC1-ESC16 templates.
- Alert on non-ASCII SPNs and unexpected servicePrincipalName writes. Restrict who can write SPNs and UPNs on privileged accounts.
- Inventory S4U and constrained delegation. Remove it where a modern path will do.
- Patch both sides of every forest trust before you flip PAC enforcement.
CVEs in this category
Showing 13 of 13
- CVE-2026-27912highResetNightmare, kpasswd bypasses PAC_REQUESTOR_SIDActive Directory (kpasswd) · Microsoft · 2026-04-14 · Patched
Kerberos Change Password (kpasswd) did not honor PAC_REQUESTOR_SID the way the rest of AD did. A low-privilege user who can write their UPN can reset a Domain Admin password. Microsoft rated it Important. Patched April 2026.
- CVE-2026-25177high 8.8KerberLoss, invisible-Unicode SPN uniqueness bypassActive Directory (Kerberos SPNs) · Microsoft · 2026-03-10 · Patched
Active Directory treated look-alike SPNs with invisible Unicode as unique. An attacker can hijack a service name, force NTLM downgrade, and steal credentials. Semperis / Shai Laron. CVSS 8.8. Patched March 2026.
- CVE-2026-20849highWindows Kerberos elevation of privilegeWindows Kerberos / Active Directory · Microsoft · 2026-02-10 · Patched
A 2026 Windows Kerberos elevation of privilege, patched by Microsoft. High severity. Read it next to KerberLoss and ResetNightmare: the 2026 AD year is a Kerberos year.
- CVE-2025-60704criticalCheckSum, Kerberos S4U missing cryptographic stepWindows Kerberos KDC (S4U) · Microsoft · 2025-11-11 · Patched
The KDC skipped a cryptographic step in PA-S4U-X509-USER (CWE-325). An attacker can forge an identity via S4U2self and escalate to domain compromise. Presented at Black Hat EU, December 2025. Silverfort named it CheckSum.
- CVE-2025-58726highSMB Server Kerberos reflection via Ghost SPNsWindows SMB Server · Microsoft · 2025-10-14 · Patched
October 2025 follow-on to CVE-2025-33073. SMB Server elevation of privilege by combining Kerberos reflection with Ghost SPNs and DNS self-registration.
- CVE-2025-33073highWindows SMB Kerberos reflection elevation of privilegeWindows SMB / Kerberos · Microsoft · 2025-06-10 · Patched
Kerberos authentication reflection on SMB, still abusable via Ghost SPNs after the first fix. High-severity elevation of privilege on Windows.
- CVE-2025-26647highWindows Kerberos PKINIT / NTAuth certificate logon bypassWindows Kerberos KDC · Microsoft · 2025-04-08 · Patched
The Windows KDC did not validate certificate-based logon (PKINIT) against NTAuth the way defenders thought. Remote elevation of privilege. Patched April 2025, with NTAuth enforcement changes you have to opt into correctly.
- CVE-2025-21242mediumWindows Kerberos information disclosureWindows Kerberos · Microsoft · 2025-01-14 · Patched
A medium-severity Kerberos information-disclosure in Windows. Not a domain-compromise bug on its own, but it sits in the same 2025 Kerberos patch train as the S4U and PKINIT failures.
- CVE-2024-49019highESC15 / EKUwu, AD CS V1 template Application Policy precedenceActive Directory Certificate Services · Microsoft · 2024-11-12 · Patched
AD CS V1 templates let Application Policy override EKU in a way that issues certificates with unintended enhanced key usages. High. Patched November 2024, still widely unpatched in 2025-2026 assessments.
- CVE-2024-29056highWindows Kerberos PAC validation in cross-forest scenariosWindows Kerberos · Microsoft · 2024-04-09 · Patched
The forest-trust sibling of CVE-2024-26248. PAC validation could be skipped across a trust. Same April 2024 patch train, same staged enforcement.
- CVE-2024-26248highWindows Kerberos PAC validation spoof, KB5020805 bypassWindows Kerberos · Microsoft · 2024-04-09 · Patched
A process could spoof the PAC signature and skip the CVE-2022-37967 checks Microsoft added in KB5020805. April 2024. Enforcement is staged: both DCs and clients must be updated or Kerberos can break.
- CVE-2024-20674high 8.8Windows Kerberos security feature bypass, impersonate the KDCWindows Kerberos · Microsoft · 2024-01-09 · Patched
An unauthenticated machine-in-the-middle can impersonate a Windows Kerberos server. CVSS 8.8. January 2024 Patch Tuesday. The 2024 opening shot in a two-year Kerberos year.
- CVE-2022-26923high 8.8Certifried, AD CS certificate mapping privilege escalationActive Directory Certificate Services · Microsoft · 2022-05-10 · Patched
The 2022 AD CS cert-based privilege escalation, still observed in incident response in 2025 (Rapid7, Unit 42). CVSS 8.8. The durable control is strong certificate mapping (KB5014754), not only the original patch.