CVE-2025-26647

Меры по смягчению последствий

To help protect your environment and prevent outages, we recommend the following steps:

• UPDATE all Windows computers and domain controllers with a Windows update released on or after April 8, 2025.
• MONITOR audit events that will be visible in Audit mode to identify all devices that are not updated.
• ENABLE Enforcement mode once your environment is no longer using certificates issued by authorities that are not in the NTAuth store.

For more information, please review: https://support.microsoft.com/help/5057784.

FAQ

What privileges could be gained by an attacker who successfully exploited the vulnerability?

An attacker who successfully exploited this vulnerability could be assigned much greater rights by the Key Distribution Center to the certificate than intended.

How could an attacker exploit this vulnerability?

An authenticated attacker could exploit this vulnerability by obtaining a certificate containing the target Subject Key Identifier (SKI) value from a Certificate Authority (CA). The attacker could then use this certificate to get a Ticket Granting Ticket (TGT) for the target user from the Key Distribution Center (KDC).