CVE-2026-25177

FAQ

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

How could an attacker exploit this vulnerability?

An attacker could exploit this issue by adding specially crafted Unicode characters to duplicate Service Principal Names (SPNs) or User Principal Names (UPNs). These characters bypass normal Active Directory checks designed to prevent duplicates. If the attacker has permission to modify SPNs on any account, they can create a duplicate SPN for a targeted service. When clients request Kerberos authentication for that service, the domain controller may issue a ticket encrypted with the wrong key, causing the service to reject the ticket. This can lead to a denial of service or force the service to fall back to NTLM authentication if it is enabled. No access to the targeted server is required beyond the initial SPN‑write permission.